Examkin

Soru

Zorluk: OrtaLog Analysis and SIEM Management

A security analyst is reviewing correlated firewall and internal DNS query logs for an internal workstation (10.0.4.15):

[Firewall Log]
Timestamp: 2026-07-27T14:15:02Z Src_IP: 10.0.4.15 Dst_IP: 198.51.100.44 Dst_Port: 53 Protocol: UDP Bytes_Sent: 4520 Bytes_Rcvd: 312 Action: ALLOW
Timestamp: 2026-07-27T14:15:05Z Src_IP: 10.0.4.15 Dst_IP: 198.51.100.44 Dst_Port: 53 Protocol: UDP Bytes_Sent: 4890 Bytes_Rcvd: 298 Action: ALLOW

[DNS Query Log]
Timestamp: 2026-07-27T14:15:02Z Client: 10.0.4.15 Query: 58617a7964617461.exfil.badactor-domain.com Type: TXT RCODE: NOERROR
Timestamp: 2026-07-27T14:15:05Z Client: 10.0.4.15 Query: 6261636b75703031.exfil.badactor-domain.com Type: TXT RCODE: NOERROR

Based on this log telemetry, which of the following statements regarding the threat activity and appropriate mitigation steps are correct? (Select TWO.)

  1. The host is utilizing DNS tunneling to exfiltrate encoded payload data within subdomain query strings.Cevap
  2. B
    The attack represents a reflected Cross-Site Scripting (XSS) payload attempting database schema extraction.
  3. Implementing DNS sinkholing or blocking external DNS resolution to the suspicious destination host will help contain the exfiltration path.Cevap
  4. D
    The activity indicates an authorization control misconfiguration causing identity verification failures on the domain controller.

Cevap

The host is utilizing DNS tunneling to exfiltrate encoded payload data within subdomain query strings, and implementing DNS sinkholing or blocking external DNS resolution to the suspicious destination host will help contain the exfiltration path.
The combination of high-entropy hexadecimal subdomains, TXT query types, and disproportionately large outbound byte counts in firewall logs over UDP port 53 is a definitive indicator of DNS tunneling. Implementing DNS sinkholing or restricting outbound DNS traffic to trusted internal recursive resolvers successfully mitigates this data exfiltration vector.

Adım Adım Çözüm

1
Analyze the DNS query logs and firewall payload metrics.
Identified high-entropy subdomains requesting TXT records with unusually high outbound byte counts relative to response byte counts over UDP port 53.
Standard DNS queries are small lookup requests; large outbound payloads containing encoded strings point to DNS covert channel/tunneling.
2
Differentiate the identified attack vector from unrelated application and identity threats.
Ruled out application vulnerabilities like XSS/SQLi and authentication control failures.
Traffic occurs at the transport and application layer specifically for DNS resolution (port 53), not web app services or AAA infrastructure.
3
Determine the optimal containment strategy.
Selected DNS sinkholing and blocking unauthorized external DNS resolution.
DNS sinkholing redirects malicious domain requests to a controlled IP, cutting off command and control and data exfiltration routes.

Anahtar Kavram

DNS Tunneling Detection and SIEM Log Correlation
Bu soruyu puanla

Konular

Log Analysis and SIEM Management

Bu konudan daha fazla soru