Question

A financial services company is designing a resilient enterprise architecture. Their threat model identifies data exfiltration via DNS tunneling as a critical risk because compromised endpoints have been observed encoding stolen data into DNS queries to attacker-controlled authoritative name servers. The security architect must design a control that preserves normal name resolution for legitimate business while preventing covert data channels over DNS. Which design approach BEST addresses this requirement?

Accepted Answer

Force all endpoint DNS traffic through a controlled internal resolver with a protective DNS service that inspects query patterns, blocks known malicious/newly-registered domains, and detects high-entropy/high-volume query anomalies, while blocking direct outbound port 53 and DoH/DoT to external resolvers

Answer

Deploy DNSSEC validation on all internal resolvers to cryptographically verify the authenticity of DNS responses received from external authoritative servers

Answer

Configure endpoints to use a public encrypted DNS provider over DoH so that all resolution traffic is confidential and cannot be tampered with in transit

Answer

Increase the TTL values on internal DNS records to reduce the total number of outbound queries endpoints must generate