Examkin

Question

Difficulty: HardNetwork Security Monitoring and Alerting

A Security Operations Center (SOC) analyst is investigating SIEM alert correlation logs for an internal endpoint with IP address 10.0.4.112. The log collector correlates recursive DNS resolver logs with outbound NetFlow records as shown below:

2026-07-27T11:02:14Z DNS_RESOLV src=10.0.4.112 qtype=TXT qname=a9f1b.data-sync-update.com rcode=NOERROR rdata="ZXhoYWlsZV9jMg=="
2026-07-27T11:03:14Z DNS_RESOLV src=10.0.4.112 qtype=TXT qname=c3k8p.data-sync-update.com rcode=NOERROR rdata="dHJhbnNtaXRfZGF0YQ=="
2026-07-27T11:04:14Z DNS_RESOLV src=10.0.4.112 qtype=TXT qname=e7m2q.data-sync-update.com rcode=NOERROR rdata="Y29tbWFuZF9hY2s=
2026-07-27T11:04:15Z NETFLOW_OUT src=10.0.4.112:49812 dst=203.0.113.88:443 bytes=148200 proto=TCP flags=ACK,PSH

Which of the following findings accurately interpret these network security monitoring logs and represent effective mitigation steps? (Select TWO.)

  1. The pattern of periodic DNS TXT queries with encoded subdomain prefixes indicates DNS tunneling used for command-and-control (C2) communication or data staging.Answer
  2. Configuring DNS sinkholing or Response Policy Zone (RPZ) rules on the local recursive resolver provides immediate containment by blocking resolution of the malicious domain.Answer
  3. C
    The log telemetry demonstrates a client-side Cross-Site Scripting (XSS) attack vector attempting to manipulate local database records via HTTP GET parameters.
  4. D
    Deploying a stateful host-based firewall rule to block all inbound UDP port 53 traffic to endpoint 10.0.4.112 is the primary control to prevent outgoing DNS queries.

Answer

The telemetry indicates DNS tunneling for command-and-control (C2) beaconing, which is best contained by implementing DNS sinkholing or Response Policy Zone (RPZ) rules.
The correct options accurately identify the threat as DNS tunneling and select the appropriate remediation. DNS tunneling encodes binary command strings into DNS subdomains and TXT record responses, providing a covert C2 channel over standard port 53 traffic. DNS sinkholing (or RPZ) is the primary containment strategy because it intercepts resolution attempts for the adversary-controlled domain at the recursive resolver level.

Step-by-Step Solution

1
Analyze the DNS protocol behavior and query characteristics.
Identified high-frequency, randomized subdomain queries under a single domain (data-sync-update.com) requesting TXT records containing Base64-encoded strings at strict 60-second intervals.
Covert channels like DNS tunneling encode payload data into DNS subdomains or record fields to bypass perimeter firewall inspection.
2
Correlate DNS telemetry with outbound flow logs.
Confirmed outbound TCP connection spikes immediately following successful DNS TXT query responses.
The C2 agent receives instructions via DNS TXT record payloads and establishes secondary egress connections based on received commands.
3
Evaluate appropriate network monitoring containment strategies.
Select DNS sinkholing / Response Policy Zones (RPZ) at the internal resolver layer.
Sinkholing prevents the compromised host from resolving malicious C2 domains, isolating the host from external adversary control while logging blocked connection attempts.

Key Concept

DNS Tunneling Detection and DNS Sinkholing Mitigation
Estimated Time:2m 0s
Rate this question

Topics

Network Security Monitoring and Alerting

More questions from this topic