CS0-003 Security Operations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Firewall logs

  Why it's wrong here

  Firewall logs record connection-level metadata such as source/destination IPs, ports, and allow/deny actions, but they do not capture the DNS query name or the response payload size. Because DNS queries are carried inside UDP/TCP payloads, a firewall might only show that traffic to port 53 occurred, without the queried domain or anomalous response lengths needed to identify tunneling. Thus firewall logs lack the DNS-specific transaction details necessary to detect or confirm DNS tunneling.

• ✗

  Endpoint registry logs

  Why it's wrong here

  Endpoint registry logs track modifications to Windows registry keys, which are primarily used to establish persistence (e.g., Run keys or services) or change system configuration, not to record network traffic. They contain no DNS query or response data, so they cannot reveal tunneling activity such as data encoded in subdomains or oversized TXT records. Even if an endpoint is compromised, registry logs would only show a potential persistence mechanism, not the exfiltration traffic itself.

• ✓

  DNS server logs

  Why this is correct

  DNS server logs are the primary source for detecting DNS tunneling because they contain the queried domain name, client IP, timestamp, record type (e.g., A, TXT, CNAME), and response size. Tunneling often manifests as base64-encoded subdomains, unusually long FQDNs, or high volumes of TXT/ANY queries with large response payloads—all visible directly in these logs. Correlating such patterns across multiple queries to the same domain from a single internal host provides strong, specific evidence of tunneling.

• ✗

  Authentication logs

  Why it's wrong here

  Authentication logs focus on identity and access events: successful and failed logins, account lockouts, and privilege escalations. They do not include DNS queries, network flows, or payload content, so they cannot indicate whether an internal host is engaging in DNS tunneling. While authentication anomalies might point to a compromised account used to launch the attack, these logs alone cannot confirm the DNS-based exfiltration activity.

• ✓

  NetFlow/IPFIX

  Why this is correct

  NetFlow/IPFIX provide flow-level metadata such as source/destination IPs, L4 ports, byte and packet counts, and flow duration, but they do not inspect payload contents. While they cannot reveal the actual domain names or DNS response data, they can expose anomalies like a single internal host sending an unusually high volume of UDP traffic to a DNS server or significantly larger-than-normal bytes per flow, which are consistent with DNS tunneling. Therefore, NetFlow is a useful corroborating source for volume-based detection, but it lacks the domain-level resolution that DNS logs provide.

Go deeper

Related to this question