Question

A SOC analyst reviewing DNS query logs from an internal workstation notices hundreds of outbound lookups per hour to domains such as 'kjf83hdsl2.info', 'zx9qmvbn4.info', and 'p1x8wqz7t.info'. Most of these queries return NXDOMAIN responses, but a small number resolve successfully to a hosting provider in another country. Which conclusion is best supported by these indicators?

Accepted Answer

The host is likely infected with malware using a domain generation algorithm (DGA) to locate its command-and-control server

Answer

The workstation is misconfigured and pointing to an invalid internal DNS resolver

Answer

A user is browsing many legitimate websites that use content delivery networks

Answer

The DNS server is performing normal cache-poisoning protection through randomized subdomains