An analyst wants to identify all external DNS resolvers being queried by internal hosts, to detect DNS bypassing the corporate resolver. Which Zeek log and query should be used?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because querying conn.log for connections on port 53 (DNS) to destinations other than the authorized corporate resolver IPs reveals hosts bypassing the corporate DNS, which could indicate malware using hardcoded DNS servers to evade policy. A is wrong because http.log shows HTTP traffic; DNS queries use port 53, not HTTP.
Full explanation below image
Full Explanation
B is correct because querying conn.log for connections on port 53 (DNS) to destinations other than the authorized corporate resolver IPs reveals hosts bypassing the corporate DNS, which could indicate malware using hardcoded DNS servers to evade policy. A is wrong because http.log shows HTTP traffic; DNS queries use port 53, not HTTP. C is wrong because ssl.log shows TLS connections; while DoH would appear on port 443, standard DNS bypass uses port 53 which is visible in conn.log. D is wrong because files.log records file transfers, not DNS query traffic.