mediumMultiple ChoiceObjective-mapped
CISSP Practice Question: A security analyst receives an alert that a host…
A security analyst receives an alert that a host in the internal network is sending abnormal amounts of traffic to an external IP. The traffic uses destination port 53. What is the most likely attack?
⚠ Common exam trap
Candidates often confuse the use of port 53 with DNS amplification attacks, but amplification requires a victim IP and open resolvers, not a single internal host sending traffic to an external IP.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DNS tunneling
The alert describes a host sending abnormal traffic to an external IP on destination port 53, which is the default port for DNS. DNS tunneling exploits the DNS protocol to encapsulate non-DNS data (e.g., commands or exfiltrated files) within DNS queries and responses, allowing covert communication through firewalls that typically allow DNS traffic. The abnormal volume of traffic to a single external IP is a classic indicator of a DNS tunnel, as the compromised host continuously sends encoded data to an external command-and-control server.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
DNS cache poisoning
Why it's wrong here
DNS cache poisoning involves injecting fraudulent resource records into a DNS resolver's cache, redirecting legitimate queries to malicious IP addresses. While highly impactful for misdirection, this attack primarily targets the integrity of DNS resolution at the resolver level, not the generation of high volumes of outgoing data exfiltration traffic from a single compromised host. It manipulates existing traffic flows rather than creating new, voluminous outbound data streams.
- ✗
DNS amplification
Why it's wrong here
DNS amplification is a type of Distributed Denial of Service (DDoS) attack where an attacker sends small DNS queries with a spoofed source IP address (the victim's) to open DNS resolvers. These resolvers then respond with much larger replies to the victim, overwhelming their network. This attack focuses on generating large incoming traffic to a target from many reflectors, not high volumes of outgoing traffic from a single compromised host attempting to exfiltrate data.
- ✓
DNS tunneling
Why this is correct
DNS tunneling is a sophisticated exfiltration technique that encapsulates non-DNS traffic, such as command-and-control communications or stolen data, within legitimate-looking DNS queries and responses. A compromised host encodes data into subdomain names or TXT records of DNS requests, sending them to an attacker-controlled authoritative DNS server. This continuous stream of data-laden DNS queries results in abnormally high volumes of outgoing DNS traffic from the host, precisely matching the alert description.
- ✗
DNS zone transfer
Why it's wrong here
A DNS zone transfer is a mechanism used by authoritative DNS servers to replicate entire DNS zone files to secondary DNS servers, ensuring redundancy and load balancing. This process involves a bulk transfer of all resource records for a domain. It is an administrative function performed between trusted DNS servers and is not a typical operation initiated by a single client host, nor is it designed as a method for covert data exfiltration from an endpoint.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.