During a routine network security monitoring review, a security analyst analyzes DNS traffic logs from an internal database server and identifies repetitive query patterns requesting long, randomized subdomains under an external domain, accompanied by large TXT record responses containing base64-encoded payloads. Which of the following initial containment and mitigation actions should the analyst take? (Select TWO.)
- Restrict outbound UDP and TCP port 53 traffic on the firewall so that internal servers can only query authorized enterprise DNS resolvers.Cevap
- BDeploy a Web Application Firewall (WAF) in front of the database server to inspect parameter values within incoming HTTP POST payloads.
- Configure internal DNS servers to sinkhole resolution requests for the malicious parent domain to a non-routable address.Cevap
- DReroute outbound port 53 traffic directly to an internal production honeypot to automatically clean and sanitize the query responses.
Cevap
The correct containment actions are restricting outbound port 53 traffic on perimeter firewalls to authorized internal resolvers and configuring internal DNS servers to sinkhole the malicious target domain.
The observed traffic pattern—high volume queries with randomized subdomains and base64 TXT responses—is a signature indicator of DNS tunneling. To mitigate this threat effectively, administrators must restrict direct outbound port 53 access from internal endpoints to prevent unauthorized external recursive lookups, and sinkhole the suspicious root domain on internal resolvers to prevent successful resolution.
Adım Adım Çözüm
Anahtar Kavram
DNS Tunneling Detection and Mitigation