CS0-003 Security Operations Practice Question
A security analyst is reviewing network traffic and suspects a host is infected with malware that uses a domain generation algorithm (DGA) for C2 communication. Which two of the following indicators are most consistent with DGA activity?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Frequent DNS queries to domains with random-looking, long subdomains
DGA domains are often algorithmically generated, resulting in random-looking, long domain names. High NXDOMAIN rates occur because many generated domains are not registered at the time of query.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
All DNS queries are to internal DNS servers
Why it's wrong here
Internal DNS servers are the standard recursive resolvers for enterprise clients; all DNS queries being directed to them simply reflects normal network configuration. Attackers rarely force clients to use external resolvers because doing so would create anomalous traffic and potentially alert security tools. Thus, this is a benign indicator and does not suggest malicious activity.
- ✓
Frequent DNS queries to domains with random-looking, long subdomains
Why this is correct
Frequent queries to domains with random-looking, long subdomains are a hallmark of Domain Generation Algorithms (DGAs). Malware uses DGAs to generate pseudorandom domain names as rendezvous points with command-and-control (C2) servers, often producing long, alphanumeric subdomains that appear nonsensical. The high query rate to such domains is a strong indicator of compromise because legitimate users rarely make repeated queries to random subdomains.
- ✗
DNS queries to domains with a high Alexa ranking
Why it's wrong here
DNS queries to domains with a high Alexa ranking are typically not suspicious because attackers rarely use popular, well-known domains. These domains are more likely to be monitored by security researchers and are often already blocked or sinkholed, making them unreliable for stealthy C2 communications. Therefore, this pattern does not indicate malicious activity.
- ✓
High volume of DNS queries resulting in NXDOMAIN responses
Why this is correct
A high volume of DNS queries resulting in NXDOMAIN responses is a classic sign of DGA-based malware. The malware rapidly queries many algorithmically generated domains to find the one that is currently registered for C2; unregistered or sinkholed domains produce NXDOMAIN errors. A surge in such responses, especially to random-looking names, is a common heuristic used by security tools to detect DGA activity.
- ✗
Consistent DNS query intervals to a single IP
Why it's wrong here
Consistent DNS query intervals to a single IP address are more indicative of beaconing to a fixed C2 server, not DGA behavior. DGA malware generates and queries many different domain names, whereas static beaconing relies on a constant, periodic connection to one endpoint. This pattern is a different kind of C2 indicator and does not align with the random, evolving nature of DGA-generated domains.
Go deeper
Related to this question
Learn chapter
Network Traffic Analysis
Key term
Malware
Malware is any software intentionally designed to cause damage, disrupt operations, steal data, or gain unauthorized access to computer systems.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
One of 236 original CS0-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.