Examkin

Question

Difficulty: MediumLog Analysis and SIEM Management

A Security Operations Center (SOC) analyst is reviewing raw telemetry in a SIEM console containing the following event logs from an internal DNS resolver and perimeter firewall:

2026-07-27T14:10:02Z dns-resolver named[2104]: query: 61646d696e2d70617373776f7264.exfil.external-badactor.net IN TXT + (10.0.4.15)
2026-07-27T14:10:05Z dns-resolver named[2104]: query: 636f6e666964656e7469616c3132.exfil.external-badactor.net IN TXT + (10.0.4.15)
2026-07-27T14:10:08Z perimeter-fw kernel: [DENY] SRC=10.0.4.15 DST=203.0.113.50 PROTO=TCP SPT=49210 DPT=443 SIG=DIRECT_OUTBOUND_RESTRICTED

Based on these correlated log entries, which of the following security findings are accurate? (Select TWO.)

  1. Host 10.0.4.15 is using DNS tunneling via hex-encoded subdomains in TXT record queries to exfiltrate data.Answer
  2. Direct outbound TCP traffic on port 443 from host 10.0.4.15 to IP address 203.0.113.50 was explicitly dropped by the perimeter firewall.Answer
  3. C
    Host 10.0.4.15 is attempting a Cross-Site Scripting (XSS) attack against the internal DNS resolver to compromise local user sessions.
  4. D
    The perimeter firewall log entries indicate an authentication bypass vulnerability within an encrypted database session.

Answer

Host 10.0.4.15 is using DNS tunneling via hex-encoded subdomains in TXT record queries to exfiltrate data, and direct outbound TCP traffic on port 443 from host 10.0.4.15 to IP address 203.0.113.50 was explicitly dropped by the perimeter firewall.
The correct findings identify DNS tunneling via hex-encoded subdomain queries for TXT records originating from host 10.0.4.15, as well as the perimeter firewall explicitly blocking direct outbound TCP port 443 traffic from that same host to IP 203.0.113.50.

Step-by-Step Solution

1
Analyze the DNS resolver log entries.
Identified high-entropy hex strings ('61646d696e...' and '636f6e6669...') prepended to query requests sent to 'exfil.external-badactor.net' via TXT records from source host 10.0.4.15.
Attackers frequently encode stolen data into DNS subdomain requests (DNS tunneling) to bypass standard perimeter inspection.
2
Analyze the perimeter firewall log entry.
Identified a '[DENY]' event for TCP traffic sourced from 10.0.4.15 trying to reach external IP 203.0.113.50 on port 443.
Firewall logs explicitly report packet filtering decisions (ALLOW/DENY/DROP) along with layer 3/4 headers.
3
Synthesize the correlated findings.
Confirmed DNS tunneling exfiltration attempts and verified that direct HTTPS connections from the internal host to the external IP address were blocked by firewall policy.
Correlating telemetry across network controls confirms both successful protocol abuse (DNS) and blocked direct channel attempts.

Key Concept

DNS Tunneling Detection and Firewall Telemetry Analysis
Rate this question

Topics

Log Analysis and SIEM Management

More questions from this topic