200-201 Network Intrusion Analysis Practice Question
An analyst notices that a DNS query for 'www.attacker.com' contains a long subdomain with Base64-encoded data. This activity is observed every 5 minutes. What exfiltration technique is most likely in use?
⚠ Common exam trap
Candidates often confuse DNS tunneling with other exfiltration methods; candidates may pick HTTP POST because they see 'data exfiltration' but miss the DNS-specific indicators like Base64 subdomains and periodic queries.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DNS tunneling
DNS tunneling encodes data within DNS queries and responses, often using Base64 or hex in subdomains, and is characterized by periodic, high-volume queries to a single domain. The long Base64-encoded subdomain and 5-minute interval are classic indicators of data exfiltration via DNS. Attackers use this because DNS is rarely blocked and often overlooked by security controls.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Steganography
Why it's wrong here
Steganography conceals data inside image, audio or video carriers, producing no anomalous DNS labels; the Base64 subdomain pattern indicates DNS tunnelling instead. It is tempting because it also hides exfiltrated data, and would be correct where modified media files leave the network rather than encoded DNS queries.
- ✓
DNS tunneling
Why this is correct
DNS tunneling uses DNS queries to exfiltrate data.
- ✗
HTTP POST exfiltration
Why it's wrong here
HTTP POST carries data in request bodies to a web server, not within DNS query labels, so it cannot explain Base64 subdomains sent every five minutes. It is tempting as the most common exfiltration channel, and would be correct if outbound POSTs to attacker.com appeared in proxy logs instead of DNS queries.
- ✗
FTP exfiltration
Why it's wrong here
FTP moves files over TCP ports 20/21, leaving no Base64 payload inside DNS subdomains; the observed periodic DNS queries point to DNS tunnelling. FTP is tempting because it is a classic bulk exfiltration channel, and would be correct where large files leave via a compromised FTP server rather than encoded DNS requests.
Visual reference
Go deeper
Related to this question
About these practice questions
This 200-201 question is part of Courseiva's 968-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.