CS0-003 Security Operations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Large DNS payload sizes

  Why this is correct

  Large DNS payload sizes are a classic indicator of tunneling because standard DNS queries and responses are deliberately small—classic UDP DNS is limited to 512 bytes without EDNS0, and even with EDNS0 typical resolvers rarely see TXT records exceeding a few hundred bytes. Tunneled traffic (via TXT or NULL records) packs encoded data into the payload, causing individual DNS messages to balloon in size and break from the statistical norm. This size anomaly is often detected when the maximum payload length or the distribution of payload sizes for a domain appears abnormal.

• ✗

  DNS responses with NXDOMAIN for most queries

  Why it's wrong here

  A steady stream of NXDOMAIN responses means the queried hostnames do not exist, which reflects failing lookups (typos, scans, or misconfigured clients) rather than successful data transfer. For tunneling to work, the attacker must authoritatively answer every crafted subdomain query with a valid response, so the answer would be NOERROR and contain a meaningful payload, not a 'non-existent domain' error. Consequently, a high NXDOMAIN rate is often a sign of DNS reconnaissance or a DDoS amplification, not covert exfiltration.

• ✓

  Non-standard record types such as TXT or NULL

  Why this is correct

  Non-standard record types such as TXT and NULL are a strong tunneling signal because they are designed to hold arbitrary data—TXT can carry multiple character-strings up to 65535 bytes total, and NULL can carry any raw binary payload. Normal enterprise DNS queries are overwhelmingly dominated by A, AAAA, and MX records; TXT records are occasionally used for SPF/DKIM verification, but those are infrequent and low in volume. A sudden spike in TXT or NULL queries to a single destination, especially with large payload sizes, is therefore a reliable forensic artifact of a tool like iodine or dns2tcp.

• ✓

  High frequency of DNS queries to a single domain

  Why this is correct

  High query volume to a single domain is suspicious because a legitimate client's DNS activity is spread across many different domains and heavily cached, so repeat queries are typically logged once per TTL. Tunneling tools, however, must send many small queries to the same authoritative server to exfiltrate data—each query can only leak a handful of bytes (e.g., 50–100 characters), so megabytes of data quickly translate into thousands of queries to the same 'zone'. This high-density query pattern, often with no prior history, is a common threshold-triggered alert in network analysis.

• ✗

  Use of standard A record queries

  Why it's wrong here

  Standard A record queries—which map hostnames to IPv4 addresses—are the backbone of legitimate DNS traffic, so their mere presence is not an anomaly and cannot by itself indicate tunneling. Even if an attacker were to use A queries for covert communication by encoding data into the query name, the encoding is typically placed in the subdomain labels, not the record type, and that pattern would be visible as unusual label entropy or length, not as the use of A records. Therefore, observing typical A queries actually describes baseline behavior and provides no discrimination between malicious and benign activity.

Go deeper

Related to this question