Refer to the exhibit. What is occurring?

An ARP flood involves sending excessive ARP requests to overwhelm a network device, which would show an abundance of ARP traffic, not unusual DNS activity.

DNS amplification is a type of DDoS attack that abuses open DNS resolvers to magnify attack traffic, typically characterized by a large volume of small queries leading to large responses directed at a victim, distinct from covert data transfer within DNS itself.

ARP poisoning involves sending forged ARP messages to redirect traffic for man-in-the-middle attacks, appearing as forged ARP responses rather than unusual DNS activity.

DNS tunneling is a technique used to exfiltrate data or establish command and control (C2) channels by encoding arbitrary data within DNS queries and responses. An exhibit showing unusual or abnormally large DNS traffic, especially with suspicious subdomains or record types, would be indicative of this covert communication method.