Examkin

Question

Difficulty: MediumLog Analysis and SIEM Management

A security analyst is investigating an automated SIEM threshold alert triggered by unusual outbound network activity from an internal host (192.168.10.114). The analyst reviews the following DNS query log entries within the SIEM dashboard:

text
27-Jul-2026 14:15:01.123 queries: info: client 192.168.10.114#49152 (a1g4z9x8q.exfil.attacker-domain.com): query: a1g4z9x8q.exfil.attacker-domain.com IN TXT +
27-Jul-2026 14:15:01.450 queries: info: client 192.168.10.114#49152 (b9k2m8p3w.exfil.attacker-domain.com): query: b9k2m8p3w.exfil.attacker-domain.com IN TXT +
27-Jul-2026 14:15:01.890 queries: info: client 192.168.10.114#49152 (c3r7v1q5n.exfil.attacker-domain.com): query: c3r7v1q5n.exfil.attacker-domain.com IN TXT +
27-Jul-2026 14:15:02.210 queries: info: client 192.168.10.114#49152 (d4m9p2k7x.exfil.attacker-domain.com): query: d4m9p2k7x.exfil.attacker-domain.com IN TXT +

Based on the log data, which of the following security events is MOST likely taking place?

  1. DNS tunneling used for data exfiltration or command-and-control communicationAnswer
  2. B
    Cross-Site Scripting (XSS) client-side payload execution on an internal server
  3. C
    Unauthorized access attempt caused by a failure in user authorization controls
  4. D
    Standard DNS zone transfer activity misidentified due to an overly sensitive correlation rule

Answer

The log entries indicate DNS tunneling used for data exfiltration or command-and-control communication.
The correct answer identifies DNS tunneling. The log snippet reveals an internal host generating rapid, high-frequency DNS queries requesting TXT records with encoded, randomized subdomains appending an external domain. Because DNS traffic often bypasses strict firewall filters, attackers encapsulate data or C2 traffic inside DNS request and response fields.

Step-by-Step Solution

1
Examine the log structure and source client
Identified client host 192.168.10.114 issuing rapid, high-frequency outbound queries to an external destination domain (attacker-domain.com).
Determining the origin and frequency of requests helps distinguish automated host behavior from regular user browsing.
2
Analyze the query record type and hostname patterns
Queries request TXT records containing randomized/encoded alphanumeric subdomains (e.g., a1g4z9x8q.exfil...).
TXT records allow arbitrary text payload retrieval, and dynamic subdomains are commonly encoded chunks of data sent to an attacker's authoritative name server.
3
Correlate patterns with known threat tactics
High-volume, encoded TXT queries targeting a single sub-domain structure match the signature of DNS tunneling for covert data exfiltration or C2.
DNS traffic is often allowed through firewalls, making it an ideal vector for protocol encapsulation and stealthy data transfer.

Key Concept

DNS Tunneling Detection via SIEM Log Analysis
Rate this question

Topics

Log Analysis and SIEM Management

More questions from this topic