When a malware-infected host attempts to resolve a known command-and-control server, the traffic matches a security policy with DNS sinkhole enabled, generating a traffic log. What will be the…

Question

Exhibit

Options

• AThe IP address specified in the sinkhole configuration.
• BThe IP address of the command-and-control server.
• CThe IP address of sinkhole.paloaltonetworks.com
• DThe IP address of one of the external DNS servers identified in the anti-spyware database.

• A
  88% (38)
• B
  2% (1)
• C
  7% (3)
• D
  2% (1)

Explanation

When DNS sinkhole is configured in an Anti-Spyware profile, the firewall intercepts DNS responses for known malicious (C2) domains and replaces the real IP address with a configured sinkhole IP address before the response reaches the infected host. The infected host then attempts to connect to this sinkhole IP. The resulting traffic log entry will show the sinkhole IP address as the destination (A) - not the actual C2 server IP - because the DNS resolution was spoofed. This allows security teams to identify infected hosts by observing which internal clients are attempting connections to the sinkhole IP. Option C is a common misunderstanding; while sinkhole.paloaltonetworks.com is a well-known default sinkhole address, the log reflects whatever IP was specified in the sinkhole configuration.

No community discussion yet for this question.