A university lab host that usually makes short DNS lookups starts a long run of queries with high-entropy names. What should the analyst suspect?
Select an answer to reveal the explanation.
Short Explanation
Ordinary DNS is a short phone-book lookup; a long string of nonsense labels is more like a smuggled note. You should suspect DNS tunneling used as a data-loss profile from that lab host. The trap is blaming a healthy campus resolver, an NTP outage, or a failed disk.
Full Explanation
The lab host normally makes short DNS lookups. It now emits a long run of queries whose names are high-entropy labels. That departure is a data-loss profile consistent with DNS tunneling, where content rides in the query names. No product default for query length is required to see the change. The suspicion is "Possible DNS tunneling as a data-loss profile, with high-entropy labels carrying content out of the lab host". A healthy campus resolver serves many clients and ordinary names. One lab host emitting high-entropy labels is not that pattern, so "A healthy recursive resolver serving ordinary lookups for the whole university campus" fails. Time service uses its own protocol. An NTP outage does not rewrite this host's lookups into high-entropy DNS names, so "An NTP outage that makes the lab host encode time checks as unusual DNS names" fails. A failed disk is a storage fault. It does not create this query pattern, so "A failed disk on the lab host that turns local file reads into those DNS queries" fails. Exam caveat: some legitimate services also use long DNS names, so the entropy is a lead for this host, not a conviction by itself. Operational check: compare this host's new names with its usual short lookups and with other campus clients, without applying an invented length cutoff.