CS0-003 Security Operations Practice Question
A SOC analyst is triaging a SIEM alert that indicates a possible DNS tunneling attack. The alert was generated based on a correlation rule that looks for unusually high DNS query volume from a single host. Which TWO additional data sources should the analyst correlate to confirm the attack?
⚠ Common exam trap
CS0-004 often tests the misconception that firewall logs are the best corroborating source for DNS tunneling, when DNS server logs and NetFlow/IPFIX provide the query content and flow volume evidence that actually confirms the tunnel.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DNS server logs
DNS server logs (C) are essential because they capture the actual query names, record types (e.g., TXT, NULL, CNAME), response sizes, and query/response patterns that reveal the encoded exfiltration payloads and high-entropy subdomains typical of DNS tunneling. NetFlow/IPFIX (E) provides flow-level metadata such as packet and byte counts, flow duration, and destination IPs/ports, which helps confirm the sustained, periodic, or oversized DNS traffic volume to an external resolver that the SIEM rule flagged. Together these sources let the analyst validate that the high query volume is anomalous in content (C) and in traffic behavior (E), which is what distinguishes tunneling from benign DNS activity. Firewall logs (A) mainly show allowed/denied connections and port usage rather than DNS query content, so they add limited confirmation value here. Endpoint registry logs (B) are unrelated to DNS query behavior, and authentication logs (D) would only help if credential abuse were suspected, neither of which supports confirming DNS tunneling.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Firewall logs
Why it's wrong here
Firewall logs record connection-level metadata such as source/destination IPs, ports, and allow/deny actions, but they do not capture the DNS query name or the response payload size. Because DNS queries are carried inside UDP/TCP payloads, a firewall might only show that traffic to port 53 occurred, without the queried domain or anomalous response lengths needed to identify tunneling. Thus firewall logs lack the DNS-specific transaction details necessary to detect or confirm DNS tunneling.
- ✗
Endpoint registry logs
Why it's wrong here
Endpoint registry logs track modifications to Windows registry keys, which are primarily used to establish persistence (e.g., Run keys or services) or change system configuration, not to record network traffic. They contain no DNS query or response data, so they cannot reveal tunneling activity such as data encoded in subdomains or oversized TXT records. Even if an endpoint is compromised, registry logs would only show a potential persistence mechanism, not the exfiltration traffic itself.
- ✓
DNS server logs
Why this is correct
DNS server logs are the primary source for detecting DNS tunneling because they contain the queried domain name, client IP, timestamp, record type (e.g., A, TXT, CNAME), and response size. Tunneling often manifests as base64-encoded subdomains, unusually long FQDNs, or high volumes of TXT/ANY queries with large response payloads—all visible directly in these logs. Correlating such patterns across multiple queries to the same domain from a single internal host provides strong, specific evidence of tunneling.
- ✗
Authentication logs
Why it's wrong here
Authentication logs focus on identity and access events: successful and failed logins, account lockouts, and privilege escalations. They do not include DNS queries, network flows, or payload content, so they cannot indicate whether an internal host is engaging in DNS tunneling. While authentication anomalies might point to a compromised account used to launch the attack, these logs alone cannot confirm the DNS-based exfiltration activity.
- ✓
NetFlow/IPFIX
Why this is correct
NetFlow/IPFIX provide flow-level metadata such as source/destination IPs, L4 ports, byte and packet counts, and flow duration, but they do not inspect payload contents. While they cannot reveal the actual domain names or DNS response data, they can expose anomalies like a single internal host sending an unusually high volume of UDP traffic to a DNS server or significantly larger-than-normal bytes per flow, which are consistent with DNS tunneling. Therefore, NetFlow is a useful corroborating source for volume-based detection, but it lacks the domain-level resolution that DNS logs provide.
Visual reference
Go deeper
Related to this question
Learn chapter
SOC Tier 1, Tier 2, and Tier 3 Analyst Roles
Key term
Correlation rule
A correlation rule is a set of conditions in a security information and event management (SIEM) system that combines multiple log events from different sources to detect complex threats or patterns that a single event would miss.
Key term
Firewall
A firewall is a network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules to protect trusted internal networks from untrusted external networks.
About these practice questions
Courseiva writes every CS0-004 question from scratch — 701 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.