SY0-701 Security Operations Practice Question
A security analyst in the SOC is investigating a potential DNS tunneling incident. The analyst has identified a workstation that is making thousands of DNS queries to an external domain with base64-encoded subdomains. The analyst suspects that sensitive files from the workstation are being exfiltrated by encoding their contents into the subdomains of the DNS queries. Which of the following log sources will provide the most definitive evidence to confirm that the contents of a specific sensitive file are being transmitted in the DNS queries?
⚠ Common exam trap
Test-takers frequently assume DNS server logs contain the full query payload, but in practice they often log only the resolved domain name and may truncate long subdomains, making packet capture the only definitive source for reconstructing exfiltrated data.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A full packet capture of the network traffic from the workstation showing the complete DNS messages.
A full packet capture (PCAP) contains the complete DNS query and response messages, including the raw payload of the subdomain fields. This allows the analyst to extract the base64-encoded data from the subdomains and decode it to verify that it matches the contents of the suspected sensitive file. DNS server logs (option A) typically only record the queried domain names, not the full DNS message payload, and may truncate long subdomains. Process creation logs (option B) show which executable made the queries but not the data being sent. Firewall logs (option D) only show connection metadata (source, destination, port) and never the DNS query content.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The DNS server logs showing the queried domains and subdomains.
Why it's wrong here
DNS server logs typically record the queried domain in a human-readable format, but they frequently truncate subdomains at a fixed length (often 255 characters total, sometimes much less) and may normalize the case, which corrupts base64-encoded data. Moreover, depending on the logging configuration, the full RDATA of the query may be omitted or aggregated, so the complete subdomain needed for decoding is often unavailable. This makes DNS logs an unreliable source for proving that the specific sensitive file content was exfiltrated.
When this WOULD be correct
A question asks: 'Which log source would best identify the external domain and subdomains being queried in a DNS tunneling incident?' In that case, DNS server logs directly show the queried domains and subdomains, making them the most definitive source for that specific purpose.
- ✗
The workstation's process creation logs showing which process initiated the DNS queries.
Why it's wrong here
Process creation logs can reveal the executable (e.g., powershell.exe or a custom binary) that initiated the DNS queries, but they only capture metadata about the process start time and command line, not the network payload. The exfiltrated data lives inside the DNS query's subdomain label, which is only visible in the packet itself. Thus, while process logs support the attacker's methodology, they cannot provide the actual file content needed to definitively confirm data exfiltration.
When this WOULD be correct
When investigating a malware infection where the primary concern is identifying the malicious executable responsible for initiating suspicious network connections, process creation logs would provide definitive evidence of the process involved.
- ✓
A full packet capture of the network traffic from the workstation showing the complete DNS messages.
Why this is correct
A full packet capture includes the entire DNS query packet, including the complete subdomain portion. The analyst can extract and decode the base64-encoded subdomain data and compare it directly to the contents of a sensitive file on the workstation to definitively confirm data exfiltration.
- ✗
The firewall logs showing outbound connections from the workstation to the external DNS server on port 53.
Why it's wrong here
Firewall logs, even with detailed network flow records, only register the five-tuple (source/destination IP, source/destination port, protocol) and occasionally byte counts or timestamps; they do not parse application-layer DNS messages. The query name and its embedded base64 subdomain are transmitted inside the DNS payload, which is invisible to the firewall. An outbound connection to a DNS server on port 53 is ordinary for any workstation, so without the full query content, these logs cannot prove that sensitive file data was sent.
When this WOULD be correct
A question asks which log source best identifies the external IP address and port used by a workstation for DNS tunneling, where the goal is to block the connection rather than inspect payload content.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SY0-701 exam frequently reuses these exact scenarios with slightly different constraints.
✓A full packet capture of the network traffic from the workstation showing the complete DNS messages.Correct answer▾
Why this is correct
A full packet capture includes the entire DNS query packet, including the complete subdomain portion. The analyst can extract and decode the base64-encoded subdomain data and compare it directly to the contents of a sensitive file on the workstation to definitively confirm data exfiltration.
✗The DNS server logs showing the queried domains and subdomains.Wrong answer — click to see why▾
Why this is wrong here
DNS server logs typically show only the queried domain names and subdomains, not the full DNS message payload. Since base64-encoded subdomains are part of the query, the logs would reveal the encoded data, but without the full packet capture, you cannot definitively confirm that the contents of a specific sensitive file are being transmitted—you only see the encoded strings, not the original file content or the exact mapping.
★ When this WOULD be the correct answer
A question asks: 'Which log source would best identify the external domain and subdomains being queried in a DNS tunneling incident?' In that case, DNS server logs directly show the queried domains and subdomains, making them the most definitive source for that specific purpose.
Why candidates choose this
Candidates may think DNS server logs capture all query details, but they often lack the full packet payload needed to reconstruct the exfiltrated data. The base64 subdomains are visible, but without the complete DNS message, you cannot prove the file content is being transmitted.
✗The workstation's process creation logs showing which process initiated the DNS queries.Wrong answer — click to see why▾
Why this is wrong here
Process creation logs show which process initiated the DNS queries but do not reveal the actual content of the DNS queries, such as the base64-encoded subdomains carrying exfiltrated data.
★ When this WOULD be the correct answer
When investigating a malware infection where the primary concern is identifying the malicious executable responsible for initiating suspicious network connections, process creation logs would provide definitive evidence of the process involved.
Why candidates choose this
Candidates may think that identifying the process is sufficient to confirm data exfiltration, overlooking that the content of the DNS queries is needed to prove the sensitive file's contents are being transmitted.
✗The firewall logs showing outbound connections from the workstation to the external DNS server on port 53.Wrong answer — click to see why▾
Why this is wrong here
Firewall logs show only connection metadata (IPs, ports, timestamps) and cannot reveal the contents of DNS queries, so they cannot confirm that file contents are being transmitted.
★ When this WOULD be the correct answer
A question asks which log source best identifies the external IP address and port used by a workstation for DNS tunneling, where the goal is to block the connection rather than inspect payload content.
Why candidates choose this
Candidates may think firewall logs capture all outbound traffic details, but they lack the application-layer data needed to see DNS query payloads.
Analysis generated from the official SY0-701blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Incident Response Process
Key term
Incident
An incident is a security event that violates an organization's policies or threatens its data, systems, or operations, requiring a structured response.
Key term
Firewall
A firewall is a network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules to protect trusted internal networks from untrusted external networks.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.