CEH Wireless, IoT and Cloud Security Practice Question
A security analyst discovers that an IoT device in a smart building is periodically sending small DNS queries to an external domain known for command-and-control activity. Which security control should be implemented to detect and block such traffic without disrupting legitimate operations?
⚠ Common exam trap
Many exam-takers confuse detection (IDS) with prevention (firewall filtering), assuming an alert is sufficient to stop the threat, but CEH emphasizes that blocking at the perimeter is required for active defense against C2 traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure egress filtering on the firewall to block outbound connections to known malicious domains.
Egress filtering on the firewall can block outbound DNS queries to known malicious domains by using a blocklist or threat intelligence feed, preventing command-and-control (C2) communication without affecting legitimate traffic to other domains. This control operates at the network perimeter, inspecting DNS requests against a reputation database and dropping matches, which is the most effective way to stop C2 traffic while allowing normal operations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Install a host-based firewall on the IoT device to restrict outbound traffic.
Why it's wrong here
Installing a host-based firewall is generally impractical for many IoT devices due to their constrained resources, limited processing power, and specialized firmware. Unlike traditional endpoints, most IoT devices lack a full-fledged operating system or the necessary architecture to support and manage such software, making this solution infeasible for widespread deployment and effective traffic control.
- ✗
Deploy an intrusion detection system (IDS) on the network to alert on suspicious DNS queries.
Why it's wrong here
While deploying an intrusion detection system (IDS) would certainly alert security analysts to suspicious DNS queries, its primary function is detection and notification, not prevention. An IDS passively monitors network traffic and generates alerts, but it does not actively block or mitigate the malicious outbound connections, leaving the IoT device vulnerable to ongoing command and control communication.
- ✓
Configure egress filtering on the firewall to block outbound connections to known malicious domains.
Why this is correct
Configuring egress filtering on the network firewall is a highly effective and proactive measure. This technique inspects and blocks outbound traffic destined for known malicious domains or IP addresses, preventing the compromised IoT device from establishing command and control (C2) communications or exfiltrating data, thereby containing the threat at the network perimeter.
- ✗
Disable DNS resolution on the IoT device to prevent any external communication.
Why it's wrong here
Disabling DNS resolution directly on the IoT device would indeed prevent it from resolving external domain names, but this drastic measure would severely impair its legitimate functionality. Many IoT devices rely on DNS for essential tasks like firmware updates, cloud service communication, or time synchronization, rendering the device inoperable or severely degraded for its intended purpose.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.