CND Practice Question: Network Security Controls Protocols And Devices
A security analyst observes that an internal host is generating excessive DNS queries containing encoded data within subdomains, indicative of a DNS tunneling attack. The network perimeter firewall allows outbound DNS traffic on UDP port 53 to any external IP. Which network security control should be implemented to mitigate this threat?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Force all internal clients to query only designated internal DNS resolvers and block direct outbound port 53 to external IPs
To prevent DNS tunneling, organizations should restrict outbound DNS queries so that internal hosts can only query authorized, internal DNS resolvers (such as corporate DNS forwarders), which then inspect or proxy external requests, blocking direct external port 53 traffic to arbitrary IPs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Block all outbound TCP and UDP port 53 traffic globally across the entire perimeter firewall
Why it's wrong here
Blocking all port 53 traffic entirely would break internet name resolution for all internal clients.
- ✓
Force all internal clients to query only designated internal DNS resolvers and block direct outbound port 53 to external IPs
Why this is correct
Restricting DNS queries to internal forwarders allows the organization to monitor, log, and filter abnormal DNS tunneling patterns effectively.
- ✗
Implement an HTTP web proxy to inspect all DNS packets at Layer 7
Why it's wrong here
HTTP web proxies inspect web traffic (HTTP/HTTPS), not raw DNS queries operating on UDP/TCP port 53.
- ✗
Enable spanning-tree root guard on all switch access ports
Why it's wrong here
Spanning-tree root guard protects against unauthorized bridge placement, having no relation to DNS traffic.
Visual reference
About these practice questions
This CND question is part of Courseiva's 323-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official EC-Council exam blueprint
This CND practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CND exam.