312-39V2: Certified SOC Analyst v2

By ECCouncil · Question Mode

QuestionQ44

VerifiedUnderstanding Cyber Threats, IoCs, and Attack Methodology

SIEM DNS logs show an internal host making numerous DNS queries with long, encoded subdomains to an external domain. The queries mainly use TXT records and take place outside business hours. The external domain was recently registered and has no known business relationship. Which option best accounts for this behavior?

Explanation

DNS tunneling encodes data in DNS query fields—commonly long subdomains—and sends it to an attacker-controlled external domain. Repeated TXT-record queries with encoded labels and anomalous timing are strong indicators of a covert DNS channel used for data exfiltration.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!