200-201 · Question #411
An analyst performs traffic analysis to detect data exfiltration and identifies a high frequency of DNS requests in a small period of time. Which technology makes this behavior feasible?
The correct answer is D. tunneling. DNS tunneling allows for data exfiltration by embedding data within DNS queries and responses, resulting in a high frequency of DNS requests to transmit information.
Question
An analyst performs traffic analysis to detect data exfiltration and identifies a high frequency of DNS requests in a small period of time. Which technology makes this behavior feasible?
Options
- Aaccess control list
- BNAT
- Cencryption
- Dtunneling
How the community answered
(24 responses)- A8% (2)
- B4% (1)
- C17% (4)
- D71% (17)
Why each option
DNS tunneling allows for data exfiltration by embedding data within DNS queries and responses, resulting in a high frequency of DNS requests to transmit information.
An access control list (ACL) is a security control that filters network traffic based on defined rules, typically preventing unauthorized access, not facilitating data exfiltration via DNS.
Network Address Translation (NAT) maps private IP addresses to public ones, which is unrelated to using DNS for data exfiltration.
While encryption protects data confidentiality, it doesn't inherently enable data exfiltration via DNS requests; rather, it could make the tunneled data harder to inspect.
DNS tunneling is a specific type of tunneling technique where data is encoded into DNS queries and responses, enabling attackers to bypass firewalls and exfiltrate data by leveraging the DNS protocol, which would manifest as a high frequency of DNS requests.
Concept tested: DNS tunneling for data exfiltration
Source: https://learn.microsoft.com/en-us/defender-for-cloud/alert-reference#dns-tunneling-detected
Topics
Community Discussion
No community discussion yet for this question.