SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  DNS tunneling used to hide command-and-control traffic.

  Why this is correct

  Repeated DNS queries for long, random subdomains are a hallmark of DNS tunneling, where an attacker encodes exfiltrated data or command-and-control messages in the domain name labels of DNS requests. Because most networks permit outbound DNS traffic, malware can use this channel to bypass firewalls and proxies, with responses from the authoritative server carrying the opposite direction of the conversation. The high entropy and volume of the subdomains make the traffic stand out to security monitoring tools.

• ✗

  A normal software update process from the operating system.

  Why it's wrong here

  A normal software update process queries well-known, predictable endpoints such as `update.microsoft.com` or vendor CDN domains, not randomly generated subdomains that change quickly. Although updates can generate a burst of DNS lookups, those lookups use fixed hostnames and do not exhibit the high-entropy, repeated, tunnel-like pattern described. Additionally, modern update traffic is typically fetched over HTTPS, with DNS only resolving a static list of addresses.

• ✗

  A successful password reset workflow for users.

  Why it's wrong here

  A successful password reset workflow involves interactive validation steps like emailed one-time codes or SMS links, which trigger only a few DNS lookups to identity provider domains. These lookups resolve to predictable, legitimate authentication endpoints and are not repeated continuously in the background. Neither the user nor the identity platform would generate a stream of long random subdomains, because the reset process is synchronous and tied to a single user action.

• ✗

  A hardware failure on the network adapter.

  Why it's wrong here

  A hardware failure on a network adapter typically causes physical-layer symptoms such as link flap, packet loss, or complete loss of connectivity, not a logical stream of DNS requests. Retransmissions would target the same destination hosts, not generate new, random subdomains, and the adapter does not craft application-layer payloads. The described DNS pattern is an application-layer indicator of tunneling, not a symptom of hardware degradation.