CS0-003 Security Operations Practice Question
An analyst is reviewing network traffic logs and notices a series of connections from an internal workstation to an external IP address on TCP port 53. The traffic consists of large DNS queries with random-looking subdomains. Which technique is most likely being used?
⚠ Common exam trap
CS0-004 often tests the confusion between DNS tunneling and DGA — both involve random-looking domains, but tunneling is about encapsulating data in DNS queries/responses, while DGA is about generating many domains for resilient C2 rendezvous.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DNS tunneling
DNS tunneling is the technique of encoding non-DNS data (such as command-and-control instructions or exfiltrated data) inside DNS queries and responses, typically using large queries with random-looking subdomains to external authoritative servers controlled by the attacker. The use of TCP port 53 with large, high-entropy subdomains from an internal workstation to an external IP is a classic DNS tunneling signature.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Domain generation algorithm (DGA)
Why it's wrong here
Domain generation algorithms (DGAs) are used by malware to dynamically generate a large number of domain names to locate command-and-control (C2) servers, evading static blocklists. In this scenario, the presence of unusually large DNS queries directed to a fixed IP address points to data encapsulation and exfiltration rather than the domain-hopping behavior characteristic of DGAs.
- ✓
DNS tunneling
Why this is correct
DNS tunneling abuses the DNS protocol by encoding non-DNS traffic, such as SSH or HTTP payloads, into the subdomains of queries sent to an attacker-controlled authoritative name server. The combination of high-volume, large-sized TXT or CNAME queries containing randomized subdomains directed to a consistent IP address is a classic signature of this exfiltration technique.
- ✗
Beaconing
Why it's wrong here
Beaconing refers to the periodic, highly structured outbound communication sent from compromised hosts to a command-and-control server to signal availability or request instructions. While beaconing can occur over DNS, its primary indicator is a consistent, repetitive timing interval (heartbeat), whereas the scenario specifically highlights large query sizes and payload characteristics indicative of data transfer.
- ✗
HTTP smuggling
Why it's wrong here
HTTP request smuggling is an application-layer attack that exploits discrepancies in how a front-end proxy and a back-end server interpret the Content-Length and Transfer-Encoding headers. This technique allows attackers to "smuggle" a request inside another, bypassing security controls, which is entirely unrelated to DNS query anomalies or network-layer tunneling.
Visual reference
Go deeper
Related to this question
About these practice questions
This CS0-004 question is part of Courseiva's 701-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.