Examkin

Question

Difficulty: Very hardLog Analysis and SIEM Management

A Security Operations Center (SOC) analyst investigating a high-severity alert in a SIEM platform correlates the following consecutive syslog entries from an internal recursive DNS resolver:

text
2026-07-27T14:22:01Z dns-resolver named[2048]: client 10.2.14.88#49152 (v1-a8f9c2d1e.exfil.external-collector.net): query: v1-a8f9c2d1e.exfil.external-collector.net IN TXT + (10.2.0.1)
2026-07-27T14:22:02Z dns-resolver named[2048]: client 10.2.14.88#49153 (v2-b7e8d3c4a.exfil.external-collector.net): query: v2-b7e8d3c4a.exfil.external-collector.net IN TXT + (10.2.0.1)
2026-07-27T14:22:03Z dns-resolver named[2048]: client 10.2.14.88#49154 (v3-f5a6b7c8d.exfil.external-collector.net): query: v3-f5a6b7c8d.exfil.external-collector.net IN TXT + (10.2.0.1)

Based on the log attributes, which of the following security events is occurring on host 10.2.14.88?

  1. DNS tunneling protocol abuse transmitting stolen payload data within encoded domain prefixes and TXT record queriesAnswer
  2. B
    A Cross-Site Scripting (XSS) exploit attempting to execute client-side scripts inside the DNS server web administration interface
  3. C
    A failure in administrative access control where host 10.2.14.88 was authenticated but denied authorization to execute system commands
  4. D
    A distributed reflective denial-of-service (DRDoS) attack targeting internal endpoint hosts with amplified response traffic

Answer

DNS tunneling protocol abuse transmitting stolen payload data within encoded domain prefixes and TXT record queries
The log entries display rapid, sequential DNS queries for TXT records containing unique, high-entropy subdomain strings (v1-a8f9c2d1e, v2-b7e8d3c4a, v3-f5a6b7c8d) under an external domain. Attackers use DNS tunneling to encapsulate covert payload data inside DNS queries to bypass standard network security controls.

Step-by-Step Solution

1
Analyze the log source and event pattern
Identified sequential DNS TXT queries originating from internal host 10.2.14.88 directed at unique subdomains of external-collector.net.
Understanding the protocol (DNS) and query record type (TXT) establishes the communication mechanism.
2
Examine query string structure and frequency
Subdomains feature high-entropy alphanumeric strings (e.g., v1-a8f9c2d1e) incrementing rapidly at 1-second intervals.
High-entropy, structured prefixes combined with regular time intervals are characteristic indicators of programmatic data encoding into DNS request labels.
3
Deduce the threat vector
Conclude that an internal compromised endpoint is utilizing DNS tunneling for covert data exfiltration to an attacker-controlled authoritative name server.
DNS traffic is frequently allowed through egress firewalls, making it a primary vector for encapsulating unauthorized outbound payload data.

Key Concept

DNS Tunneling and Log Analysis
Rate this question

Topics

Log Analysis and SIEM Management

More questions from this topic