nerdexam
CompTIA

CAS-003 · Question #549

A technician receives the following security alert from the firewall's automated system: Evidence: host repeatedly visited a dynamic DNS domain (17 time) After reviewing the alert, which of the…

The correct answer is B. this alert indicates a user was attempting to bypass security measures using dynamic DNS. Repeated host connections to a dynamic DNS domain are a strong indicator of an attempt to bypass DNS-based security controls or of malware using dynamic DNS for command-and-control communication.

Enterprise Security Operations

Question

A technician receives the following security alert from the firewall's automated system:

Evidence: host repeatedly visited a dynamic DNS domain (17 time) After reviewing the alert, which of the following is the BEST analysis?

Exhibit

CAS-003 question #549 exhibit

Options

  • Athe alert is a false positive because DNS is a normal network function.
  • Bthis alert indicates a user was attempting to bypass security measures using dynamic DNS.
  • Cthis alert was generated by the SIEM because the user attempted too many invalid login attempts.
  • Dthis alert indicates an endpoint may be infected and is potentially contacting a suspect host.

How the community answered

(37 responses)
  • A
    14% (5)
  • B
    76% (28)
  • C
    3% (1)
  • D
    8% (3)

Why each option

Repeated host connections to a dynamic DNS domain are a strong indicator of an attempt to bypass DNS-based security controls or of malware using dynamic DNS for command-and-control communication.

Athe alert is a false positive because DNS is a normal network function.

While DNS lookups are normal, repeated queries specifically to a dynamic DNS provider is anomalous behavior that should not be dismissed as a false positive without investigation.

Bthis alert indicates a user was attempting to bypass security measures using dynamic DNS.Correct

Dynamic DNS services allow the IP address behind a domain to change frequently, which attackers and malware use to evade static IP blocklists and DNS reputation filters enforced by security controls. A host visiting the same dynamic DNS domain 17 times is consistent with deliberate use of dynamic DNS to circumvent security filtering, whether by a user or by malware installed on an endpoint. This pattern warrants investigation as a potential policy violation or active compromise indicator.

Cthis alert was generated by the SIEM because the user attempted too many invalid login attempts.

The alert was generated by the firewall's automated system based on DNS domain visit evidence, not by the SIEM, and the evidence does not mention failed login attempts.

Dthis alert indicates an endpoint may be infected and is potentially contacting a suspect host.

An infected endpoint contacting a suspect host via dynamic DNS is a related but secondary explanation; the primary finding is the use of dynamic DNS to bypass security measures.

Concept tested: Dynamic DNS as security bypass and C2 indicator

Source: https://attack.mitre.org/techniques/T1568/001/

Topics

#dynamic DNS#security alert analysis#C2 detection#firewall logs

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CAS-003 Practice