Examkin

Question

Difficulty: MediumLog Analysis and SIEM Management

A security analyst reviewing SIEM alert logs identifies the following sequential events originating from an internal workstation:

2026-07-27T14:02:11Z Event: DNS_QUERY SrcIP: 10.0.4.150 DstIP: 8.8.8.8 Query: c2FtcGxlZGF0YWV4Zmls.malicious-domain.com RecordType: TXT Length: 512
2026-07-27T14:02:12Z Event: DNS_QUERY SrcIP: 10.0.4.150 DstIP: 8.8.8.8 Query: dG9wc2VjcmV0ZG9jcw==.malicious-domain.com RecordType: TXT Length: 512
2026-07-27T14:02:13Z Event: DNS_QUERY SrcIP: 10.0.4.150 DstIP: 8.8.8.8 Query: cGFzc3dvcmRoYXNoZXM=.malicious-domain.com RecordType: TXT Length: 512

Which of the following security threats is directly indicated by these log entries?

  1. DNS tunneling used for covert data exfiltrationAnswer
  2. B
    A DNS amplification attack targeted at saturating internal network switches
  3. C
    Cross-Site Scripting (XSS) attempting to steal session cookies
  4. D
    An unauthorized Kerberos ticket granting request attempting identity spoofing

Answer

The correct answer is DNS tunneling used for covert data exfiltration.
The log entries demonstrate DNS tunneling. The presence of rapidly generated TXT record queries containing unique, Base64-encoded subdomains sent to an external domain indicates that an internal host is encoding data into DNS queries to bypass traditional firewall and proxy filters for data exfiltration.

Step-by-Step Solution

1
Analyze the log entries for protocol type, query format, and record attributes.
The logs reveal repeated outbound DNS queries asking for TXT records with long, Base64-encoded strings as subdomains under an external domain (malicious-domain.com).
Identifying encoded payloads embedded inside DNS subdomains distinguishes protocol tunneling from standard hostname resolution requests.
2
Evaluate the pattern against known threat tactics.
Attackers encode sensitive data (such as Base64 strings decoding to 'sampledataexfil', 'topsecretdocs', and 'passwordhashes') into DNS queries to bypass standard perimeter security controls.
DNS traffic is frequently allowed outbound without inspection, making TXT record queries an ideal vehicle for covert data exfiltration.

Key Concept

DNS Tunneling and Data Exfiltration Detection in SIEM Logs
Estimated Time:1m 30s
Rate this question

Topics

Log Analysis and SIEM Management

More questions from this topic