CEH Footprinting, Reconnaissance and Scanning Practice Question

You are investigating a suspected data exfiltration. Network logs show an internal host performing numerous DNS queries to a domain that does not exist in any organization records. The queries use various subdomains. Which technique is the attacker MOST likely using?

⚠ Common exam trap

Watch out — candidates often confuse DNS tunneling with DNS amplification attacks because both involve many DNS queries, but amplification is a DDoS technique focused on volume, not covert data exfiltration via subdomain encoding.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

DNS tunneling

The attacker is most likely using DNS tunneling, which encodes data from exfiltrated information into DNS queries and responses. By making numerous DNS queries to a domain they control, with data encoded in the subdomain labels, the attacker can bypass network security controls that do not inspect DNS traffic deeply. The fact that the domain does not exist in organization records and uses various subdomains is a classic indicator of DNS tunneling.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
DNS amplification attack
Why it's wrong here
DNS amplification attacks are a type of Distributed Denial of Service (DDoS) attack where attackers leverage open DNS resolvers to flood a target with an overwhelming volume of traffic. By sending small, spoofed DNS queries to numerous resolvers, the attacker causes these resolvers to send much larger responses to the victim's spoofed IP address. This technique aims to exhaust the target's bandwidth or resources, making it unavailable, rather than extracting data from a compromised network.
✗
DNS cache poisoning
Why it's wrong here
DNS cache poisoning involves injecting fraudulent DNS records into a DNS resolver's cache, causing it to return incorrect IP addresses for legitimate domain names. This manipulation redirects users attempting to access a legitimate website to an attacker-controlled malicious server instead. The primary goal is to misdirect traffic for phishing or malware distribution, not to covertly exfiltrate data from a compromised internal system.
✗
DNS zone transfer
Why it's wrong here
A DNS zone transfer is a legitimate process used by secondary DNS servers to obtain an exact copy of a zone file from a primary DNS server, ensuring redundancy and consistency across DNS infrastructure. While it involves copying DNS record data, it is a standard administrative function for public record synchronization, not a stealthy mechanism for an attacker to exfiltrate arbitrary sensitive data from a compromised internal host. It exposes public DNS information, not internal network secrets.
✓
DNS tunneling
Why this is correct
DNS tunneling is a sophisticated data exfiltration technique that encapsulates arbitrary data within DNS queries and responses, creating a covert communication channel. Attackers use this method to bypass firewalls and intrusion detection systems that typically allow DNS traffic, enabling them to extract sensitive information from a compromised internal network to an external command-and-control server. This technique effectively hides data transfer in plain sight, making it a potent tool for stealthy data theft.

Visual reference

Go deeper

CEH Footprinting, Reconnaissance and Scanning Practice Question

Why each option matters

Option-by-option breakdown

Related to this question