hardMultiple SelectObjective-mapped
200-201 Practice Question: A security analyst discovers that an attacker…
A security analyst discovers that an attacker exfiltrated data using DNS tunneling. Which TWO controls should be implemented to detect or prevent this? (Select two.)
⚠ Common exam trap
Cisco often tests the misconception that DNSSEC or disabling recursion can stop DNS tunneling, but DNSSEC only signs records and does not inspect payloads, while disabling recursion breaks internal resolution without affecting external tunneling via forwarders.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Monitor DNS query sizes and frequencies
DNS tunneling often involves unusually large query sizes (e.g., encoded data in subdomains) and abnormal query frequencies (e.g., thousands of requests per minute). Monitoring these metrics allows analysts to spot deviations from baseline behavior, which is a key detection technique for exfiltration via DNS. Option B is correct because a DNS sinkhole redirects malicious or suspicious DNS queries to a controlled IP address, effectively blocking the resolution of domains used for tunneling and preventing data from reaching the attacker's command-and-control server.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Monitor DNS query sizes and frequencies
Why this is correct
Unusually large or frequent queries may indicate tunneling.
- ✓
Use a DNS sinkhole
Why this is correct
A sinkhole redirects known malicious domains, preventing exfiltration.
- ✗
Disable recursive DNS on the internal DNS server
Why it's wrong here
This does not block tunneling through external recursive resolvers.
- ✗
Implement DNSSEC
Why it's wrong here
DNSSEC ensures DNS data integrity but does not detect tunneling.
- ✗
Block all DNS queries to external servers
Why it's wrong here
This would prevent legitimate DNS resolution and internet access.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 979 original 200-201 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.