John, a professional hacker, decided to use DNS to perform data exfiltration on a target network, in this process, he embedded malicious data into the DNS protocol packets that even DNSSEC cannot…

The correct answer is C. DNS tunneling method. DNS Tunneling Explained DNS Tunneling (Option C) is correct because it is a technique that encodes malicious data or commands within DNS protocol packets, allowing attackers to bypass firewalls and establish covert communication channels between a victim machine and a Command &…

Submitted by thandi_sa· Mar 6, 2026Evading IDS, Firewalls, and Honeypots

Question

John, a professional hacker, decided to use DNS to perform data exfiltration on a target network, in this process, he embedded malicious data into the DNS protocol packets that even DNSSEC cannot detect. Using this technique. John successfully injected malware to bypass a firewall and maintained communication with the victim machine and C&C server. What is the technique employed by John to bypass the firewall?

Options

ADNS cache snooping
BDNSSEC zone walking
CDNS tunneling method
DDNS enumeration

How the community answered

(31 responses)

A
3% (1)
B
10% (3)
C
71% (22)
D
16% (5)

Explanation

DNS Tunneling Explained

DNS Tunneling (Option C) is correct because it is a technique that encodes malicious data or commands within DNS protocol packets, allowing attackers to bypass firewalls and establish covert communication channels between a victim machine and a Command & Control (C&C) server - all while appearing as legitimate DNS traffic that even DNSSEC cannot detect, since DNSSEC only validates authenticity, not packet content.

Why the distractors are wrong:

A (DNS Cache Snooping) involves querying a DNS server's cache to discover which domains have been recently visited - it's a reconnaissance technique, not a data exfiltration or firewall bypass method.
B (DNSSEC Zone Walking) exploits DNSSEC's NSEC records to enumerate all DNS records in a zone - again, a reconnaissance method, not tunneling or exfiltration.
D (DNS Enumeration) is the broader process of gathering DNS information about a target (subdomains, MX records, etc.) for intelligence gathering, not for bypassing firewalls or maintaining C&C communication.

Memory Tip: Think of DNS Tunneling as "smuggling data inside mail envelopes" - the firewall sees normal DNS "envelopes" but doesn't inspect what's hidden inside. If the scenario involves bypass + C&C + covert communication, always think Tunneling.

Topics

#DNS tunneling#Firewall evasion#Data exfiltration#C2 communication

Community Discussion

No community discussion yet for this question.

Full 312-50V13 Practice