An NSM analyst wants to identify hosts that may be participating in a DGA (Domain Generation Algorithm) botnet. Which combination of Zeek log fields most effectively identifies DGA activity?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — a is correct because DGA malware generates many pseudo-random domain names and queries them until one resolves to an active C2 server; this produces a high volume of NXDOMAIN responses and domains with high lexical entropy or random character patterns in dns.log. B is wrong because large data transfers with long durations suggest data exfiltration, not DGA activity.
Full explanation below image
Full Explanation
A is correct because DGA malware generates many pseudo-random domain names and queries them until one resolves to an active C2 server; this produces a high volume of NXDOMAIN responses and domains with high lexical entropy or random character patterns in dns.log. B is wrong because large data transfers with long durations suggest data exfiltration, not DGA activity. C is wrong because HTTP POST to low-ranked domains may indicate suspicious web activity but is not characteristic of DGA. D is wrong because long-lived SSL certificates are a certificate hygiene issue but do not indicate DGA.