CND Network Attacks And Defense Strategies Practice Question
A security analyst suspects that an internal host has been compromised and is communicating via an encrypted Command and Control (C2) channel utilizing DNS tunneling. Which Wireshark filter and analysis technique should the analyst employ to definitively identify this anomaly?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Filter for 'dns' and inspect query strings for abnormally high length, high entropy, or encoded character patterns.
DNS tunneling embeds arbitrary data within DNS queries (typically in the subdomain labels). Filtering for DNS traffic and analyzing exceptionally long query names containing high entropy or Base64-encoded strings is the standard methodology to detect DNS tunneling.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Filter for 'http.request.method == POST' and look for binary attachments.
Why it's wrong here
This filter applies to HTTP web traffic uploads, not DNS queries.
- ✗
Filter for 'tcp.port == 443' and inspect the TLS Server Name Indication (SNI) extension.
Why it's wrong here
TLS SNI inspection is used for HTTPS traffic, whereas DNS operates primarily over UDP/TCP port 53.
- ✓
Filter for 'dns' and inspect query strings for abnormally high length, high entropy, or encoded character patterns.
Why this is correct
DNS tunneling manifests as unusually long and complex query names destined for recursive resolvers.
- ✗
Filter for 'icmp' and examine the payload size of Echo Request packets.
Why it's wrong here
ICMP payload inspection detects ICMP tunneling (ping tunneling), not DNS tunneling.
Visual reference
About these practice questions
Courseiva writes every CND question from scratch — 323 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official EC-Council exam blueprint
This CND practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CND exam.