Question

A security analyst notices that a single internal host is generating an unusually high volume of DNS queries to a rarely-used external domain. The queries contain long, seemingly random subdomain strings, and the corresponding TXT responses are also large. No other protocols show anomalous activity from this host. Which threat does this behavior most likely indicate?

Accepted Answer

DNS tunneling used for data exfiltration and command-and-control

Answer

A DNS amplification distributed denial-of-service attack

Answer

DNS cache poisoning against the internal resolver

Answer

A dictionary-based brute-force attack on DNS zone transfers