A SOC analyst reviews DNS telemetry and sees a workstation resolving hundreds of algorithmically generated domains at fixed intervals, with most responses returning NXDOMAIN. What evidence should the analyst prioritize to validate command-and-control beaconing? In the containment trade-off phase, Which response balances containment with evidence preservation?

Search only for successful HTTP 200 responses

DGA activity may fail resolution frequently, so HTTP status codes alone miss the behaviour.

Block all DNS traffic from the subnet

Immediate blanket blocking may disrupt operations and does not validate the source process.

Delete the host from the SIEM asset inventory

Removing context makes investigation harder and does not contain the threat.

What does this CS0-003 question test?

CIDR notation defines the prefix length.

What is the correct answer to this question?

The correct answer is: Correlate DNS query logs with endpoint process and network connection telemetry — The pattern is suspicious, but process and connection context shows whether a host process is repeatedly attempting outbound C2 communication. This keeps the analysis focused on containment trade-off rather than broad, low-value actions.

What should I do if I get this CS0-003 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.