A senior security engineer flags the following log file snippet as having likely facilitated an attacker's lateral movement in a recent breach: Which of the following solutions, if implemented…

The correct answer is A. Disabling DNS zone transfers. The log snippet shows a DNS zone transfer (AXFR), which allows the attacker to obtain a list of all DNS records in the compTIA.org domain, potentially aiding lateral movement. Disabling DNS zone transfers would prevent unauthorized entities from retrieving the entire DNS zone…

Submitted by thandi_sa· Mar 6, 2026Security Engineering

Question

A senior security engineer flags the following log file snippet as having likely facilitated an attacker's lateral movement in a recent breach:

Which of the following solutions, if implemented, would mitigate the risk of this issue reoccurring?

Exhibits

Options

ADisabling DNS zone transfers
BRestricting DNS traffic to UDP'W
CImplementing DNS masking on internal servers
DPermitting only clients from internal networks to query DNS

How the community answered

(34 responses)

A
79% (27)
B
6% (2)
C
3% (1)
D
12% (4)

Explanation

The log snippet shows a DNS zone transfer (AXFR), which allows the attacker to obtain a list of all DNS records in the compTIA.org domain, potentially aiding lateral movement. Disabling DNS zone transfers would prevent unauthorized entities from retrieving the entire DNS zone, thus mitigating the risk of an attacker discovering internal systems for further exploitation.

Community Discussion

No community discussion yet for this question.

Full CAS-005 Practice