mediumMultiple ChoiceObjective-mapped
CS0-003 Practice Question: A security analyst notices that a system is…
A security analyst notices that a system is sending a large amount of data to an external IP address via DNS tunneling. Which containment technique is most appropriate?
⚠ Common exam trap
CompTIA often tests the principle that containment must be immediate and host-level for active data exfiltration, and the trap here is that candidates choose firewall-based blocking (Option C) thinking it stops the traffic, but fail to realize the attacker can easily change IPs or use multiple resolvers, making host isolation the only sure containment.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Disconnect the system from the network
Disconnecting the system from the network (Option B) is the most appropriate containment technique because it immediately stops all data exfiltration, including DNS tunneling traffic, without relying on any other network component. DNS tunneling works by encoding data within DNS queries and responses, so simply changing DNS server settings or blocking the external IP may not stop the attack if the malware uses fallback resolvers or rotates IPs. Disconnecting the system ensures the threat is isolated at the host level, preventing further data loss while preserving forensic evidence.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Change the DNS server settings
Why it's wrong here
Changing the system's configured DNS server settings is an insufficient countermeasure because sophisticated DNS tunneling often involves an attacker-controlled authoritative DNS server. The compromised system might be hardcoded to use specific malicious DNS resolvers or directly query the attacker's server, completely bypassing local network DNS configurations. Furthermore, the tunneling might already be established, and simply changing settings won't terminate active connections or prevent future attempts if the malware persists.
- ✓
Disconnect the system from the network
Why this is correct
Disconnecting the system from the network is the most immediate and effective first response to suspected data exfiltration via tunneling. This action instantly severs all network communication, preventing any further data loss, command and control (C2) traffic, or lateral movement by the attacker. It provides a critical window for incident responders to analyze the system in a controlled environment without ongoing risk.
- ✗
Block the external IP at the firewall
Why it's wrong here
Blocking a specific external IP address at the firewall is an incomplete solution because attackers frequently employ multiple command and control (C2) servers or leverage dynamic DNS to rotate IP addresses. While it might temporarily disrupt communication with one known endpoint, the compromised system could quickly switch to an alternate IP, domain, or even a different tunneling protocol. This action also fails to address the persistent threat residing on the internal system itself.
- ✗
Disable the DNS service on the system
Why it's wrong here
Disabling the DNS client service on the system is an overly disruptive and potentially ineffective action. While it might prevent DNS-based tunneling, it would severely impair legitimate system functionality, preventing it from resolving hostnames for essential services and applications. Moreover, attackers can utilize other protocols for tunneling, such as ICMP, HTTP/S, or even custom TCP/UDP ports, rendering a DNS service disablement entirely irrelevant to those methods.
Visual reference
Go deeper
Related to this question
Learn chapter
Threat Intelligence and Threat Hunting
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Malware
Malware is any software intentionally designed to cause damage, disrupt operations, steal data, or gain unauthorized access to computer systems.
About these practice questions
One of 236 original CS0-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.