SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
Exhibit
DNS query log excerpt: Host: CORP-LT-17 16:18:02 a9f3d1k2d.update-check.com A NXDOMAIN 16:18:03 b7p9q2s1n.update-check.com A NXDOMAIN 16:18:04 k8z1m4c7r.update-check.com A NXDOMAIN 16:18:05 u3n6t9x0v.update-check.com A NXDOMAIN 16:18:06 9q2m7a4p1.update-check.com A NXDOMAIN Proxy log excerpt: No corresponding HTTP or HTTPS sessions observed TTL observed: 60 seconds on all queries
Based on the exhibit, what is the MOST likely explanation for the network traffic?
The affected host is not showing a large amount of internet-bound traffic, but its DNS behavior is highly unusual.
⚠ Common exam trap
The trap here is that candidates may overlook the significance of 'unusual DNS behavior' and minimal internet traffic, instead focusing on common attacks like ARP poisoning or benign browser features, which would produce different traffic patterns (e.g., high traffic or periodic HTTP requests).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DNS tunneling used for command-and-control or data transfer
The exhibit shows a host with minimal internet-bound traffic but highly unusual DNS behavior, such as frequent queries to a single domain or large DNS query sizes. This pattern is characteristic of DNS tunneling, where data is encoded in DNS queries and responses to bypass network controls, often used for command-and-control (C2) communication or covert data exfiltration. The lack of other traffic indicates the host is not performing normal web browsing or data transfers, making DNS tunneling the most likely explanation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
DNS tunneling used for command-and-control or data transfer
Why this is correct
The repeated queries to long, randomly generated subdomains, combined with the prevalence of NXDOMAIN responses and the absence of ordinary browsing traffic, are classic indicators of DNS tunneling. In this technique, malware encapsulates command-and-control messages or exfiltrated data into the domain namespace, encoding payloads in subdomain labels and receiving instructions or data in DNS replies such as TXT records. The NXDOMAIN responses may represent either intentional 'no data' signals from the malicious authoritative server or failed resolution attempts that are still part of the tunnel's call-and-response pattern.
- ✗
ARP poisoning causing the host to redirect traffic to a rogue gateway
Why it's wrong here
ARP poisoning would redirect frames at the data-link layer by correlating the gateway's IP address with the attacker's MAC address, causing the victim's traffic to be sent to a rogue gateway. While that could expose DNS queries to interception, it would not itself produce the distinctive DNS pattern of long random subdomains and NXDOMAIN responses. Instead, the host would typically show ARP table anomalies and experience degraded or failing connectivity for all internet traffic, not a steady stream of structured DNS lookups.
- ✗
A browser cache synchronization feature repeatedly polling a cloud service
Why it's wrong here
A legitimate browser cache synchronization feature relies on well-known service domain names and consistent endpoints that resolve correctly, and it uses HTTP/HTTPS requests rather than raw DNS queries to update state. The observed pattern of random-looking subdomains and repeated NXDOMAIN results indicates domains that do not exist, which is not how a cloud service would behave. Synchronization traffic would also involve valid DNS resolutions to actual IP addresses, not a high volume of unresolvable subdomains.
- ✗
A misconfigured static route sending all web traffic to the wrong subnet
Why it's wrong here
A misconfigured static route operates at the network layer, diverting IP packets to an incorrect next hop on the basis of the destination prefix, which would typically cause broad connectivity loss or timeouts for many services. It would not generate a directed series of DNS queries with haphazard subdomain labels and NXDOMAIN answers, because the DNS resolver itself would remain unchanged and would still be queried with normal hostnames. The signature of random labels and non-existent domain responses points to a crafted DNS tunnel, not a routing issue.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.