A SOC analyst is reviewing logs and notices that a DNS query for 'abcdefghijklmnopqrstuvwxyz1234567890.malicious-domain.com' returned an A record. Combined with high query frequency, what attack is most likely occurring?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because DNS tunneling encodes data in DNS subdomain strings (which can be long and appear random); the authoritative server for the domain decodes the query data and encodes responses in DNS records (A, TXT, CNAME), creating a bidirectional covert channel through DNS. A is wrong because DNS amplification uses legitimate DNS resolvers as reflectors to flood a victim; it does not involve long encoded subdomains from an internal host.
Full explanation below image
Full Explanation
B is correct because DNS tunneling encodes data in DNS subdomain strings (which can be long and appear random); the authoritative server for the domain decodes the query data and encodes responses in DNS records (A, TXT, CNAME), creating a bidirectional covert channel through DNS. A is wrong because DNS amplification uses legitimate DNS resolvers as reflectors to flood a victim; it does not involve long encoded subdomains from an internal host. C is wrong because Kaminsky attacks target DNS resolver caches with forged responses; they do not involve long subdomain strings in outbound queries. D is wrong because BGP is a routing protocol; DNS queries do not affect BGP routing.