CS0-003 Security Operations Practice Question
A security analyst is investigating a potential data exfiltration using DNS. Which TWO indicators are most consistent with DNS tunneling?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DNS responses with unusually large payload sizes
DNS tunneling often uses high query volume and large response sizes to encode data. Unusual TLDs are less common; frequent NXDOMAIN may indicate DGA, not tunneling.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Frequent NXDOMAIN responses
Why it's wrong here
NXDOMAIN responses occur when a queried name does not exist. DNS tunneling relies on domains that are registered and resolve successfully so that encoded data can be transmitted via TXT records or query names. A high rate of NXDOMAIN responses is more indicative of domain-generation algorithm (DGA) malware or typo-squatting, not data exfiltration through DNS tunnels.
- ✓
DNS responses with unusually large payload sizes
Why this is correct
Normal DNS responses are typically small, often under 512 bytes when using traditional UDP limits. During DNS tunneling, attackers encode exfiltrated data into TXT records or other response fields, causing responses to be several kilobytes or larger. Such unusually large payloads are a direct and strong indicator that DNS is being used to transfer unauthorized data, making this the correct sign of data exfiltration.
- ✓
Unusually high volume of DNS queries to a single domain
Why this is correct
DNS tunneling tools often embed data into subdomain labels of queries, which are limited to 63 characters per label. To transfer a meaningful amount of data, an attacker must send thousands of queries to a single malicious domain, creating a distinctive high-volume spike in DNS traffic. This query-frequency pattern is a classic behavioral signature of DNS tunneling and should raise immediate suspicion.
- ✗
Queries for domains with unusual top-level domains (e.g., .tk)
Why it's wrong here
While malicious DNS tunneling may sometimes use free or odd-looking top-level domains like .tk, many legitimate services and ad tracker domains also use unusual TLDs. The presence of such TLDs alone is not a specific or reliable indicator of tunneling, as normal enterprise traffic frequently includes queries to .tk, .xyz, or similar domains. Therefore, this observation is weak evidence without additional corroborating factors.
- ✗
Multiple queries from different hosts to the same legitimate domain
Why it's wrong here
In a typical enterprise, multiple hosts often query the same legitimate domain for content delivery, software updates, or cloud services. DNS tunneling is usually performed from a single compromised host communicating with one attacker-controlled domain, not spread uniformly across many hosts. Consequently, this pattern is more consistent with normal business traffic and is not strongly indicative of DNS exfiltration.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every CS0-004 question from scratch — 236 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.