200-201 Security Monitoring Practice Question
A security analyst is investigating a potential data exfiltration incident. Which TWO of the following are common indicators that data exfiltration may be occurring over DNS? (Choose two.)
⚠ Common exam trap
Cisco often tests the distinction between normal DNS behavior (e.g., CDN responses with many IPs) and anomalous patterns specific to tunneling, so candidates mistakenly pick A or E because they sound 'unusual' without understanding the underlying exfiltration mechanism.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
High volume of DNS queries to a single domain not normally visited
A high volume of DNS queries to a single domain that is not normally visited is a classic indicator of DNS tunneling, where an attacker encodes exfiltrated data into DNS query subdomains. This behavior creates an abnormal query pattern that stands out in baseline traffic analysis.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
DNS responses with a large number of IP addresses
Why it's wrong here
This could indicate DNS amplification, not exfiltration.
- ✗
DNS queries for AAAA records (IPv6) from an IPv4-only network
Why it's wrong here
This is unusual but not a strong indicator of exfiltration.
- ✓
High volume of DNS queries to a single domain not normally visited
Why this is correct
A sudden surge of queries to an unknown domain could indicate a DNS tunnel.
- ✓
Unusually large DNS TXT record responses
Why this is correct
Large TXT records are used to carry exfiltrated data; normal TXT records are typically small.
- ✗
DNS query responses with high TTL values
Why it's wrong here
TTL values are not typically associated with data exfiltration; they affect caching.
Visual reference
Go deeper
Related to this question
About these practice questions
This 200-201 question is part of Courseiva's 979-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.