A Zeek analyst reviews logs and finds repeated DNS queries from an internal host to randomly-generated domain names that all resolve to the same external IP. What attack technique does this MOST likely indicate?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because malware using DGA generates large numbers of pseudo-random domain names, attempting to contact one that resolves to an active C2 server. The pattern of many random domains resolving to the same IP is the classic DGA indicator.
Full explanation below image
Full Explanation
B is correct because malware using DGA generates large numbers of pseudo-random domain names, attempting to contact one that resolves to an active C2 server. The pattern of many random domains resolving to the same IP is the classic DGA indicator. A is wrong because DNS cache poisoning involves corrupting cached records, not generating random query names. C is wrong because amplification attacks use external DNS servers as reflectors and produce high-volume responses. D is wrong because NXDOMAIN flooding from misconfiguration would show all queries failing, not resolving to the same IP.