A SOC analyst is reviewing correlated telemetry in a SIEM console following an automated h… — CompTIA Security+

A SOC analyst is reviewing correlated telemetry in a SIEM console following an automated high-severity alert:

Host Firewall Logs:
2026-07-27T10:13:58Z ALLOW UDP 172.16.42.50:53124 -> 8.8.8.8:53 (Bypassing internal DNS resolver 172.16.0.2)

Based on the log telemetry, which of the following security events is occurring, and which containment action should be implemented first?

DNS tunneling for data exfiltration; block direct outbound UDP/53 traffic from internal endpoints and enforce routing through designated internal recursive DNS resolvers.Cevap
B
Distributed Denial of Service (DDoS) reflection attack; configure SIEM threshold rules to drop incoming ICMP echo responses.
C
Cross-Site Scripting (XSS) payload delivery; apply web application firewall (WAF) input validation rules to encode TXT parameters.
D
Unauthorized privilege escalation via RADIUS; revoke user authorization tokens on the enterprise authentication server.

Cevap

DNS tunneling for data exfiltration; block direct outbound UDP/53 traffic from internal endpoints and enforce routing through designated internal recursive DNS resolvers.

The combination of high-frequency DNS TXT queries carrying encoded subdomains, combined with endpoint firewall logs demonstrating direct outbound connection to an external DNS server (bypassing internal DNS infrastructure), is a classic signature of DNS tunneling used for data exfiltration. Mitigating this risk requires blocking direct external DNS access from end-user devices so that all queries pass through monitored internal resolvers.

Adım Adım Çözüm

Analyze the log telemetry structure and query attributes

The log shows sequential, high-frequency TXT queries to unique, long, random subdomains (e.g., a3f9b1c2e4d.data.example-cdn.net) with large payload lengths (~240 bytes).

Covert channels like DNS tunneling encode exfiltrated data into subdomain strings of DNS queries.

Examine host firewall routing anomalies

Endpoint 172.16.42.50 is querying public DNS (8.8.8.8) directly, bypassing the designated internal DNS server (172.16.0.2).

Attackers bypass internal DNS monitoring and logging controls by attempting direct egress over port 53.

Identify the primary containment control

Block direct outbound UDP/TCP port 53 traffic at perimeter firewalls for non-DNS servers and require all internal clients to use approved internal DNS resolvers.

Enforcing internal recursive DNS usage enables central logging, filtering, and blocking of malicious domain requests.

Anahtar Kavram

DNS Tunneling and Exfiltration Telemetry Correlation

Soru

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Konular

Bu konudan daha fazla soru