CS0-003 Security Operations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Normal DNS resolution

  Why it's wrong here

  Standard DNS resolution primarily utilizes UDP port 53 for lightweight queries, occasionally falling back to TCP port 53 only for large zone transfers or responses exceeding 512 bytes. It does not natively encrypt this traffic. Finding persistent, encrypted traffic on TCP port 53 indicates highly anomalous behavior rather than standard, unencrypted name resolution.

• ✗

  Beaconing to command and control

  Why it's wrong here

  While command-and-control (C2) agents do beacon to external servers, this activity typically relies on standard web protocols like HTTP or HTTPS over ports 80 and 443 to blend in with normal user browsing. While DNS can be used for C2, the specific presence of heavy, encrypted TCP/53 traffic is more indicative of bulk data exfiltration via tunneling rather than low-and-slow beaconing pulses.

• ✓

  Data exfiltration via DNS tunnelling

  Why this is correct

  Attackers frequently use DNS tunneling to bypass firewalls by encapsulating non-DNS protocols and encrypted payloads inside DNS packets. Because TCP port 53 allows for larger, reliable data streams compared to UDP, persistent encrypted traffic on this port is a classic indicator of an active data exfiltration channel.

• ✗

  HTTP smuggling attack

  Why it's wrong here

  HTTP request smuggling is an exploitation technique that targets the discrepancies in how front-end proxies and back-end servers parse HTTP request boundaries. This attack vector is strictly confined to HTTP/HTTPS traffic (typically ports 80 and 443) and has no technical relationship with DNS protocols or TCP port 53.

Go deeper

Related to this question