Which Zeek log file would an analyst examine to identify DNS queries for newly registered or unusual domains associated with C2 infrastructure?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because Zeek's dns.log records all DNS queries and responses including queried domain names, response codes, and resolved IPs, making it the primary source for DNS-based threat hunting. A is wrong because conn.log records network connections but does not contain DNS query names.
Full explanation below image
Full Explanation
B is correct because Zeek's dns.log records all DNS queries and responses including queried domain names, response codes, and resolved IPs, making it the primary source for DNS-based threat hunting. A is wrong because conn.log records network connections but does not contain DNS query names. C is wrong because http.log records HTTP transactions, not DNS queries. D is wrong because files.log records file transfers extracted from network traffic, not DNS activity.