SY0-701 Security Operations Practice Question
Exhibit
DNS telemetry for host LAP-09: 10:14:02 query=TXT name=k7f3a9d1a.reporting-updates.net client=10.1.8.44 10:15:02 query=TXT name=m2b8c4.reporting-updates.net client=10.1.8.44 10:16:02 query=TXT name=q9z1x7.reporting-updates.net client=10.1.8.44 10:17:02 query=TXT name=t4n8p2.reporting-updates.net client=10.1.8.44 Packet summary: 58-byte UDP responses, repeated every 60 seconds Proxy logs: no HTTP or HTTPS sessions to reporting-updates.net EDR: python.exe launched by signed pdf reader, process exited in 3 seconds EDR network telemetry: same pattern continued after the document closed
Based on the exhibit, what is the best-supported conclusion for the SOC analyst?
⚠ Common exam trap
Candidates often confuse DNS tunneling with normal DNS resolution for CDN services, but the key differentiator is the abnormal volume and structure of the DNS queries, not the destination IP addresses.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The host is likely using DNS tunneling or DNS-based command and control.
The exhibit shows a high volume of DNS queries to multiple unusual domains with long subdomain strings, which is a classic indicator of DNS tunneling or DNS-based command and control (C2). DNS tunneling encodes data in DNS queries and responses, allowing attackers to exfiltrate data or communicate with a C2 server while bypassing traditional network controls. The SOC analyst should recognize this pattern as anomalous DNS activity rather than normal web browsing.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The traffic is normal web browsing to a content delivery network.
Why it's wrong here
Normal web browsing to a content delivery network would generate HTTP or HTTPS requests to standard ports (80/443) with visible GET/POST paths, and would show TCP handshakes and data transferred over those connections. The exhibit instead shows repeated DNS TXT queries, which are UDP-based DNS record lookups carrying no web session data. A CDN might legitimately serve content via HTTPS, but it would not explain the absence of any web requests and the exclusive use of DNS queries.
- ✓
The host is likely using DNS tunneling or DNS-based command and control.
Why this is correct
The repeated TXT queries, predictable timing, small UDP payloads, and absence of proxy traffic strongly suggest data or commands are being carried over DNS. The unique subdomains and steady beacon interval are classic indicators of DNS tunneling or DNS-based command-and-control. The signed PDF reader only shows how the activity may have started, not that it is benign.
- ✗
The issue is most likely ARP spoofing on the local switch port.
Why it's wrong here
ARP spoofing operates at Layer 2, poisoning the IP-to-MAC mapping on a local switch port to redirect traffic to an attacker's machine, causing misrouted frames and MITM interception. It would produce duplicate IP/MAC bindings in the ARP cache and unusual ARP replies, but it would not cause the host to generate a continuous stream of DNS TXT queries at a predictable interval. The exhibit shows a stealthy DNS beacon pattern, which is unrelated to local Layer 2 address resolution issues.
- ✗
The evidence most strongly indicates a password spraying campaign.
Why it's wrong here
Password spraying involves an attacker trying a few common passwords against many user accounts across the network, which generates failed authentication events, account lockouts, and traffic to authentication services like LDAP, Kerberos, or web single sign-on portals. The exhibit contains no such authentication logs or login attempts; instead, it shows a single host emitting DNS TXT queries with unique subdomains on a regular schedule. This beaconing behavior indicates command-and-control or data exfiltration, not a brute-force credential attack.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.