200-201 Security Monitoring Practice Question
An analyst is reviewing DNS logs and sees a high volume of NXDOMAIN responses for a specific domain. Which TWO scenarios could this indicate?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DNS amplification attack
High NXDOMAIN responses may indicate a DNS amplification attack (using resolvers to amplify traffic) or fast-flux DNS (rapidly changing IPs for malicious domains).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
DNS amplification attack
Why this is correct
Attackers send queries that return large responses, causing NXDOMAIN.
- ✓
Fast-flux DNS activity
Why this is correct
Fast-flux uses many different IPs, some may be non-existent leading to NXDOMAIN.
- ✗
DNS tunneling
Why it's wrong here
DNS tunneling uses successful queries, not NXDOMAIN.
- ✗
Legitimate website misconfiguration
Why it's wrong here
Misconfiguration typically returns consistent NXDOMAIN for specific records, not high volume.
- ✗
Normal DNS caching behavior
Why it's wrong here
Caching does not generate high NXDOMAIN volume.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-201 question from scratch — 979 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.