CS0-003 Security Operations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Firewall logs

  Why it's wrong here

  While firewall logs record connection attempts, port usage (such as UDP/TCP port 53), and packet counts, they typically lack the deep packet inspection capabilities required to analyze the actual DNS query and response payloads. Consequently, security analysts cannot inspect the specific subdomains or TXT records used in DNS tunneling attacks through standard firewall logs alone.

• ✓

  DNS logs

  Why this is correct

  DNS logs capture the complete transaction details, including the requested domain names, query types (such as TXT, MX, or CNAME), and the corresponding server responses. This granular payload visibility is essential for identifying the high-frequency, anomalously long, or encoded subdomains characteristic of DNS tunneling and data exfiltration techniques.

• ✗

  EDR telemetry

  Why it's wrong here

  Endpoint Detection and Response (EDR) telemetry excels at monitoring local host behaviors, process executions, registry changes, and file system modifications. However, it does not natively capture or parse the raw, network-wide DNS transaction payloads flowing between internal resolvers and external authoritative name servers, making it inefficient for direct network-level tunneling detection.

• ✗

  NetFlow data

  Why it's wrong here

  NetFlow data provides valuable metadata regarding network conversations, including source/destination IP addresses, ports, protocols, and byte counts. While it can highlight volume anomalies on port 53, it does not capture the actual application-layer DNS payload, rendering it unable to distinguish legitimate queries from malicious, encapsulated data payloads.

Go deeper

Related to this question