hardMultiple SelectObjective-mapped
200-201 Practice Question: An analyst is investigating a potential data…
An analyst is investigating a potential data exfiltration. Which two indicators in network traffic are most indicative of data exfiltration over DNS? (Choose two.)
⚠ Common exam trap
Cisco often tests the misconception that any deviation from normal DNS behavior (like retransmissions or non-standard ports) is malicious, but the key indicators for exfiltration are unusually large response sizes and a high volume of queries to suspicious domains.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Large DNS response packets
Large DNS response packets (Option B) are indicative of data exfiltration because attackers often encode stolen data into DNS TXT or other record types, causing response sizes to exceed the typical 512-byte limit and triggering EDNS0 extensions. This anomaly stands out against normal DNS traffic, where most responses are small.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use of standard DNS ports
Why it's wrong here
Normal behavior, not indicative of exfiltration.
- ✓
Large DNS response packets
Why this is correct
Used to carry exfiltrated data in DNS responses.
- ✗
DNSSEC enabled
Why it's wrong here
DNSSEC is a security extension, not related to exfiltration.
- ✗
Frequent DNS query retransmissions
Why it's wrong here
Can occur due to network issues, not exfiltration specific.
- ✓
High volume of DNS queries to unusual domains
Why this is correct
Indicates potential tunneling for exfiltration.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 979 original 200-201 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.