mediumMultiple ChoiceObjective-mapped
CS0-003 Practice Question: A SOC analyst reviews DNS telemetry and sees a…
A SOC analyst reviews DNS telemetry and sees a workstation resolving hundreds of algorithmically generated domains at fixed intervals, with most responses returning NXDOMAIN. What evidence should the analyst prioritize to validate command-and-control beaconing? In the evidence source phase, Which evidence source best supports or refutes the detection?
⚠ Common exam trap
The trap here is that candidates often focus on the DNS NXDOMAIN responses alone and choose a reactive action like blocking traffic (Option C) or deleting the host (Option B), instead of recognizing that correlation with endpoint telemetry is required to validate the detection before any response.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Correlate DNS query logs with endpoint process and network connection telemetry
Correlating DNS query logs with endpoint process and network connection telemetry (Option D) provides direct evidence of command-and-control (C2) beaconing by linking the algorithmically generated domain (AGD) queries to a specific process initiating outbound connections. This cross-referencing validates whether the DNS activity is part of a malware's C2 channel, as legitimate applications rarely generate hundreds of NXDOMAIN responses at fixed intervals. The SOC analyst can confirm the detection by identifying the parent process (e.g., a suspicious executable) and matching its network connections to the queried domains.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Search only for successful HTTP 200 responses
Why it's wrong here
Searching only for successful HTTP 200 responses is insufficient for detecting Domain Generation Algorithm (DGA) activity because DGA often involves numerous failed DNS resolutions before any potential success. HTTP responses only occur after successful DNS resolution and TCP connection establishment, meaning this approach would entirely miss the characteristic pattern of many failed DNS queries that are indicative of DGA attempts, regardless of C2 server availability.
- ✗
Delete the host from the SIEM asset inventory
Why it's wrong here
Deleting the host from the SIEM asset inventory is counterproductive and dangerous, as it removes critical historical context, baseline data, and correlation points essential for a thorough incident investigation. This action does not contain the active threat on the workstation; instead, it severely hinders the ability to track the host's malicious activities, identify the initial compromise vector, and understand the full scope of the breach, making remediation far more challenging.
- ✗
Block all DNS traffic from the subnet
Why it's wrong here
Blocking all DNS traffic from an entire subnet is an overly aggressive and indiscriminate response that would cause significant operational disruption across all legitimate services and users within that segment. This blanket action fails to isolate the specific compromised host or process, preventing necessary communication for uninfected systems and potentially hindering the investigation by cutting off valuable monitoring opportunities for the suspected command-and-control traffic.
- ✓
Correlate DNS query logs with endpoint process and network connection telemetry
Why this is correct
Correlating DNS query logs with endpoint process and network connection telemetry is the most effective approach to validate and understand suspicious DGA activity. This comprehensive analysis allows security analysts to pinpoint the specific process generating the unusual DNS queries, observe subsequent network connection attempts (or failures), and confirm if the host is indeed attempting outbound command-and-control communication, thereby enabling precise and targeted remediation efforts.
Visual reference
Go deeper
Related to this question
Learn chapter
Network Traffic Analysis
Key term
Telemetry
Telemetry is the automatic collection, transmission, and measurement of data from remote sources to a central system for analysis and monitoring.
Key term
Malware
Malware is any software intentionally designed to cause damage, disrupt operations, steal data, or gain unauthorized access to computer systems.
About these practice questions
Courseiva writes every CS0-004 question from scratch — 236 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.