CCOA: Certified Cybersecurity Operations Analyst

By Isaca · Question Mode

QuestionQ43

VerifiedIncident Detection and Response

An attacker has compromised several systems on an organization’s network and is exfiltrating data through the Domain Name System (DNS) server by crafting DNS queries. Which of the following is the BEST mitigation strategy to prevent data exfiltration through this technique?

Explanation

Blocking outbound DNS traffic prevents compromised hosts from sending crafted DNS queries to external attacker-controlled DNS infrastructure, eliminating the DNS exfiltration channel. CISA guidance similarly recommends allowing external DNS queries only from designated DNS resolvers and denying outbound UDP/53 traffic from all other systems.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!