Question

A SOC analyst reviewing outbound traffic profiles notices a workstation generating an unusually high volume of DNS TXT record queries to a single external domain over several hours. Total DNS traffic from this host is many times the baseline, though no large file transfers appear over HTTP or FTP. Which potential data loss concern does this traffic profile most likely indicate?

Accepted Answer

Data exfiltration via DNS tunneling, where stolen data is encoded into DNS queries

Answer

A denial-of-service attack targeting the organization's internal DNS server

Answer

Normal DNS caching behavior that reduces repeated external lookups

Answer

An ARP spoofing attack redirecting traffic on the local subnet