CS0-003 Security Operations Practice Question
During a network traffic analysis, a security analyst notices a high volume of DNS queries to a domain that is algorithmically generated. The domain names follow a random pattern and are not resolved to known IP addresses. Which technique is most likely being used?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Domain generation algorithm (DGA)
Domain Generation Algorithms (DGAs) are commonly used by malware to generate a large number of potential C2 domain names to evade static blocklists.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
DNS tunneling
Why it's wrong here
While DNS tunneling also abuses the Domain Name System, its primary purpose is to encapsulate non-DNS traffic, such as SSH or HTTP payloads, within standard DNS queries and responses to bypass network security controls. It relies on established, attacker-controlled domains to exfiltrate data or tunnel protocols, rather than dynamically generating a high volume of pseudo-random domain names to evade IP-based blocking.
- ✗
Beaconing
Why it's wrong here
Beaconing refers to the regular, periodic outbound communication sent from compromised hosts to a command-and-control (C2) server to signal availability or check for instructions. While malware using a domain generation algorithm may exhibit beaconing behavior during its connection attempts, the specific mechanism of programmatically generating pseudo-random domain names to locate changing C2 infrastructure is distinct from the timing-based nature of beaconing.
- ✓
Domain generation algorithm (DGA)
Why this is correct
A Domain Generation Algorithm (DGA) is a technique used by malware to periodically generate a large number of pseudo-random domain names that can be used as rendezvous points for command-and-control (C2) servers. This allows attackers to evade static domain blocking and IP reputation lists, as the malware and the attacker only need to register a single domain from the generated list to establish a successful connection.
- ✗
HTTP smuggling
Why it's wrong here
HTTP request smuggling is an application-layer attack that exploits discrepancies in how front-end proxy servers and back-end web servers parse the Content-Length and Transfer-Encoding headers. This technique allows an attacker to smuggle a malicious request inside a legitimate one, leading to session hijacking, cache poisoning, or security filter bypasses, which is entirely unrelated to DNS-based command-and-control evasion.
Visual reference
Go deeper
Related to this question
Learn chapter
Executive Security Reporting
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Analysis
In incident response, analysis is the process of examining data and events to determine what happened, how it happened, and what actions to take.
About these practice questions
This CS0-004 question is part of Courseiva's 701-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.