hardMultiple ChoiceObjective-mapped
Cisco CyberOps Associate: DNS Tunneling Detection — Random Subdomain Queries
An analyst observes a sudden spike in DNS queries from an internal host to a random subdomain of a legitimate domain (e.g., randomstring.google.com). This behavior is consistent with which technique?
Quick Answer
The correct answer is DNS tunneling for data exfiltration. This technique works by encoding stolen data into the subdomain labels of DNS queries—such as randomstring.google.com—where each query carries a small payload of exfiltrated information, allowing attackers to bypass firewalls and proxies that typically permit DNS traffic. On the Cisco CyberOps Associate 200-201 exam, this scenario tests your ability to recognize anomalous DNS patterns as a key indicator of compromise (IoC), often appearing in questions about data exfiltration methods or network-based attacks. A common trap is confusing this with a DDoS amplification attack, but remember that DNS tunneling involves a single internal host generating many unique subdomain queries to a legitimate domain, not a flood of requests to random external servers. For a quick memory tip: think of the subdomain as a “secret envelope” carrying data out through the DNS door.
⚠ Common exam trap
Cisco often tests the distinction between DNS tunneling (data exfiltration) and DNS amplification (DDoS attack), so candidates may confuse the high volume of queries in tunneling with the reflection/amplification mechanism of a DDoS attack.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DNS tunneling for data exfiltration.
The sudden spike in DNS queries to random subdomains of a legitimate domain (e.g., randomstring.google.com) is a classic indicator of DNS tunneling. This technique encodes data into DNS query names and exfiltrates it through the DNS protocol, bypassing network security controls that allow DNS traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
DNS tunneling for data exfiltration.
Why this is correct
Uses DNS queries to covertly send data.
- ✗
HTTP beaconing to a C2 server.
Why it's wrong here
Uses HTTP, not DNS.
- ✗
DNS amplification attack.
Why it's wrong here
Uses open resolvers to flood victim.
- ✗
Port scanning using DNS.
Why it's wrong here
DNS not used for port scanning.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 979 original 200-201 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on 200-201
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A SOC analyst is tuning a correlation rule that detects DNS tunneling. The rule currently generates 500 alerts per day, but only 5% are true positives. Which tuning approach would best reduce false positives while maintaining detection efficacy?
hard- A.Lower the entropy threshold for domain names from 3.5 to 2.0.
- B.Disable the rule and rely on manual review of DNS logs.
- C.Increase the observation time window from 1 hour to 24 hours.
- ✓ D.Add a condition that the number of unique domains queried per source IP exceeds 10 per minute.
Why D: DNS tunneling typically involves a single infected host querying many unique domains (often algorithmically generated) at a high rate to exfiltrate data. By requiring more than 10 unique domains per minute per source IP, the rule filters out low-volume, legitimate DNS traffic that may have slightly random-looking domains, while still catching the high-frequency queries characteristic of active tunneling. This reduces the false positive rate from 95% to a more manageable level without requiring a lower entropy threshold that would miss subtle tunneling.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.