mediumMultiple ChoiceObjective-mapped
200-201 Practice Question: Refer to the exhibit
Exhibit
Refer to the exhibit.
! Cisco ASDM configuration
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
dns-guard
!Refer to the exhibit. An administrator sees many alerts for DNS tunneling. The current DNS inspection policy is shown. What change would most likely help detect DNS tunneling?
⚠ Common exam trap
Cisco often tests the misconception that lowering the message-length maximum would block tunneling, when in fact tunneling uses large payloads that would be ignored or passed through if the limit is too low, so raising the limit is required to inspect and detect the oversized messages.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Raise the message-length maximum to 4096 bytes.
DNS tunneling exploits the DNS protocol to exfiltrate data by encoding it in DNS queries and responses. Raising the message-length maximum to 4096 bytes allows the DNS inspection engine to inspect larger DNS payloads, which is necessary to detect tunneling attempts that use long TXT or other resource records to carry data. The current lower limit may allow tunneled data to pass undetected because the inspection engine truncates or ignores oversized messages.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Remove the dns-guard command.
Why it's wrong here
Removing protection reduces security.
- ✗
Lower the message-length maximum to 128 bytes.
Why it's wrong here
Lowering may cause false positives and block legitimate traffic.
- ✓
Raise the message-length maximum to 4096 bytes.
Why this is correct
Larger messages allow tunneling to be observed; also, correlating with frequency can detect anomalies.
- ✗
Disable DNS inspection entirely.
Why it's wrong here
Inspection is needed to detect anomalies.
Visual reference
Go deeper
Related to this question
About these practice questions
This 200-201 question is part of Courseiva's 979-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.