The answer is inadequate monitoring of DNS traffic for anomalies. This is correct because DNS tunneling detection failure occurs when security teams overlook the very protocol designed to bypass traditional defenses—DNS queries and responses are rarely blocked at firewalls, allowing attackers to encode stolen data within TXT records or high-entropy subdomains that blend seamlessly with legitimate traffic. On the CISM exam, this scenario tests your understanding that even sophisticated controls fail without visibility into protocol-specific behavior; a common trap is assuming encryption alone would be flagged, when in fact encrypted DNS tunneling can persist for months if no baseline for normal query volume or record types exists. Remember the memory tip: “DNS doesn’t lie, but it can hide—monitor the queries, not just the ports.”
CISM Incident Management Practice Question
This CISM practice question tests your understanding of incident management. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
During an incident investigation, the security team discovers that an attacker exfiltrated sensitive customer data via encrypted DNS tunneling over a period of three months. The data loss was only noticed after a routine audit. Which of the following weaknesses MOST likely allowed the attacker to remain undetected for so long?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "most likely"
Why it matters: Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Inadequate monitoring of DNS traffic for anomalies
The correct answer is A because DNS tunneling exfiltrates data by encoding it within DNS queries and responses, which are often allowed through firewalls without deep inspection. The attacker remained undetected for three months because the security team lacked monitoring of DNS traffic for anomalies, such as unusual query volumes, non-standard record types (e.g., TXT records), or domains with high entropy. Without DNS-specific anomaly detection or a security information and event management (SIEM) system correlating DNS logs, the exfiltration blended into normal traffic.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
Inadequate monitoring of DNS traffic for anomalies
Why this is correct
Without monitoring DNS traffic for tunneling, exfiltration can go unnoticed for long periods.
Clue confirmation
The clue word "most likely" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
✗
Weak password policies
Why it's wrong here
Weak passwords could lead to initial compromise but not specifically to undetected exfiltration.
✗
Unpatched web server software
Why it's wrong here
Unpatched software may be an entry vector, but DNS tunneling detection is about network monitoring.
✗
Lack of data-at-rest encryption
Why it's wrong here
Data-at-rest encryption protects stored data but does not detect exfiltration.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates may focus on the initial breach vector (e.g., unpatched software or weak passwords) rather than the detection failure that allowed the exfiltration to persist undetected for months, which is the core of the question.
Detailed technical explanation
How to think about this question
DNS tunneling works by encapsulating data in DNS query and response packets, often using base32 or base64 encoding to fit within the 255-byte limit of a DNS label. Tools like dnscat2 or Iodine create a command-and-control channel over UDP port 53, which is rarely blocked. Detection requires analyzing DNS query entropy, frequency, and domain length; for example, a sudden spike in TXT record queries to a single domain with subdomains like 'a1b2c3d4.evil.com' is a red flag.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A small business has 20 workstations on the 192.168.1.0/24 network and one public IP from its ISP. The router uses PAT (NAT overload) so all 20 devices share one public address using different source ports. NAT questions test whether you understand the four address terms and which direction each translation applies.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Incident Management — This question tests Incident Management — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Inadequate monitoring of DNS traffic for anomalies — The correct answer is A because DNS tunneling exfiltrates data by encoding it within DNS queries and responses, which are often allowed through firewalls without deep inspection. The attacker remained undetected for three months because the security team lacked monitoring of DNS traffic for anomalies, such as unusual query volumes, non-standard record types (e.g., TXT records), or domains with high entropy. Without DNS-specific anomaly detection or a security information and event management (SIEM) system correlating DNS logs, the exfiltration blended into normal traffic.
What should I do if I get this CISM question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Are there clue words in this question I should notice?
Yes — watch for: "most likely". Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.