SY0-701 Security Operations Practice Question
An NDR tool shows a production web server sending small, periodic DNS queries to random-looking subdomains under a domain the company does not use. The pattern repeats every 60 seconds, even when normal web traffic is idle. What is the best interpretation and next step?
⚠ Common exam trap
The trap here is that candidates may mistake periodic DNS queries for legitimate maintenance traffic (like certificate renewal or NTP sync) and overlook the key indicator of random-looking subdomains under an unused domain, which is a hallmark of DNS tunneling for C2.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Suspect DNS-based command-and-control, then isolate the server and collect logs and packet data for analysis.
The small, periodic DNS queries to random-looking subdomains under an unused domain are a classic indicator of DNS-based command-and-control (C2) communication. Attackers often use DNS tunneling to exfiltrate data or send commands, as DNS traffic is typically allowed through firewalls. The fact that the pattern persists even during idle web traffic confirms it is not related to normal server operations, making isolation and forensic collection the appropriate next step.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
This is normal DNS behavior, so no action is needed unless users report an outage.
Why it's wrong here
The observed pattern is not normal DNS: typical business name resolution is sporadic and user-driven, while this server emits fixed-interval queries to random-looking subdomains—a classic beacon for DNS tunneling or command-and-control. Waiting until users report an outage is reactive and allows the suspected compromise to continue, potentially exfiltrating data. Even if no user is impacted, the security team must investigate the anomaly rather than dismiss it as routine traffic.
- ✓
Suspect DNS-based command-and-control, then isolate the server and collect logs and packet data for analysis.
Why this is correct
Regular outbound DNS queries to random subdomains can indicate tunneling or command-and-control traffic. The fact that it repeats at a fixed interval strengthens that suspicion. The best next step is to contain the host so the activity cannot continue, while preserving logs and packet captures for investigation. This lets the team determine whether malware, a rogue process, or a misconfiguration is responsible without losing evidence.
- ✗
Rotate the DNS server’s administrator password and leave the web server online.
Why it's wrong here
Rotating the DNS server's administrator password protects the management plane of the DNS infrastructure, but it does nothing to stop a web server that is generating outbound DNS queries. The suspicious traffic originates from the web server itself, not from a compromise of DNS server credentials, so the host remains an active source of command-and-control or tunneling. The correct response is to isolate the web server and preserve evidence, while treating the password rotation as a separate hygiene task if there is evidence of administrative access.
- ✗
Assume the web server is performing routine certificate renewal checks and ignore the alert.
Why it's wrong here
Certificate renewal flows such as ACME or OCSP involve retrieving a specific certificate or status from a known CA or update endpoint, not generating random alphanumeric subdomains. A fixed-interval stream of unique, random-looking subdomains to an unknown domain is characteristic of a domain-generation algorithm (DGA) used by malware to rendezvous with C2 infrastructure. Ignoring the alert as routine would let an attacker maintain persistence and potentially exfiltrate sensitive data from the production web server.
Go deeper
Related to this question
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.