200-201 Network Intrusion Analysis Practice Question
A network analyst is investigating a suspected DNS tunneling attack. Which THREE of the following are indicators of DNS tunneling?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Unusually high volume of DNS queries to a single domain
DNS tunneling often involves high volumes of DNS queries to a single domain, large payloads in TXT records, and encoded data in subdomains to exfiltrate data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
DNS queries for well-known domains like google.com
Why it's wrong here
These are normal and not indicative of tunneling.
- ✓
Unusually high volume of DNS queries to a single domain
Why this is correct
High query volume can indicate data exfiltration via DNS.
- ✓
DNS queries with long subdomain names containing encoded characters
Why this is correct
Encoded data in subdomains is a common tunneling technique.
- ✗
Low volume of DNS queries from internal hosts
Why it's wrong here
Low volume is not suspicious.
- ✓
DNS responses with large TXT record sizes
Why this is correct
Large TXT records can carry exfiltrated data.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 979 original 200-201 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.