nerdexam
Cisco

200-201 · Question #411

An analyst performs traffic analysis to detect data exfiltration and identifies a high frequency of DNS requests in a small period of time. Which technology makes this behavior feasible?

The correct answer is D. tunneling. DNS tunneling allows for data exfiltration by embedding data within DNS queries and responses, resulting in a high frequency of DNS requests to transmit information.

Submitted by akirajp· Mar 6, 2026Network Intrusion Analysis

Question

An analyst performs traffic analysis to detect data exfiltration and identifies a high frequency of DNS requests in a small period of time. Which technology makes this behavior feasible?

Options

  • Aaccess control list
  • BNAT
  • Cencryption
  • Dtunneling

How the community answered

(24 responses)
  • A
    8% (2)
  • B
    4% (1)
  • C
    17% (4)
  • D
    71% (17)

Why each option

DNS tunneling allows for data exfiltration by embedding data within DNS queries and responses, resulting in a high frequency of DNS requests to transmit information.

Aaccess control list

An access control list (ACL) is a security control that filters network traffic based on defined rules, typically preventing unauthorized access, not facilitating data exfiltration via DNS.

BNAT

Network Address Translation (NAT) maps private IP addresses to public ones, which is unrelated to using DNS for data exfiltration.

Cencryption

While encryption protects data confidentiality, it doesn't inherently enable data exfiltration via DNS requests; rather, it could make the tunneled data harder to inspect.

DtunnelingCorrect

DNS tunneling is a specific type of tunneling technique where data is encoded into DNS queries and responses, enabling attackers to bypass firewalls and exfiltrate data by leveraging the DNS protocol, which would manifest as a high frequency of DNS requests.

Concept tested: DNS tunneling for data exfiltration

Source: https://learn.microsoft.com/en-us/defender-for-cloud/alert-reference#dns-tunneling-detected

Topics

#Data exfiltration#DNS tunneling#Traffic analysis#Network protocols

Community Discussion

No community discussion yet for this question.

Full 200-201 Practice