CS0-003 · Question #642
During a routine review of DNS logs, a security analyst observes that Host X has been making frequent DNS requests to domains with random alphanumeric strings (e.g.. atd8ekthj.xyz). IPS anomaly rules
The correct answer is D. Use threat intelligence to check if the queried domains are associated with legitimate sites.. Random, algorithmically generated domain names are a common indicator of malware using domain generation algorithms (DGAs). Checking the queried domains against threat intelligence is the fastest way to confirm whether they are malicious and whether the host is likely
Question
During a routine review of DNS logs, a security analyst observes that Host X has been making frequent DNS requests to domains with random alphanumeric strings (e.g.. atd8ekthj.xyz). IPS anomaly rules are blocking these domains. This behavior started shortly after a new software Installation on the host. Which of the following should the analyst do first to determine whether Host X has been compromised?
Options
- AAllow the domains because the DNS requests are part of a misconfigured software update.
- BCheck the software installation logs for errors and reinstall the software.
- CBlock all outbound connections from the host to prevent further DNS queries.
- DUse threat intelligence to check if the queried domains are associated with legitimate sites.
How the community answered
(27 responses)- A11% (3)
- B7% (2)
- C4% (1)
- D78% (21)
Explanation
Random, algorithmically generated domain names are a common indicator of malware using domain generation algorithms (DGAs). Checking the queried domains against threat intelligence is the fastest way to confirm whether they are malicious and whether the host is likely
Topics
Community Discussion
No community discussion yet for this question.