2.9 Describe Evasion and Obfuscation Techniques, Such as Tunneling, Encryption, and Proxies 200-201 Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A network administrator notices that a server inside the DMZ is sending large volumes of DNS queries to an external DNS server. The queries contain long subdomains with random-looking strings. The administrator suspects DNS tunneling. Which action would best confirm this suspicion?

   • ACheck if the DNS server is configured to allow recursive queries from the internet
   • BVerify that the DNS queries are signed with DNSSEC
   • CBlock all outbound DNS traffic to external servers
   • DInspect the DNS query payloads for encoded data that, when decoded, reveals non-DNS content
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A security analyst is reviewing network traffic and sees that a host is making HTTPS connections to a cloud-based service that is known to be a proxy. The analyst suspects the user is using the proxy to bypass the corporate web filter. However, the corporate firewall is configured to allow HTTPS traffic. Which additional evidence would most strongly indicate that the user is using the proxy to evade the filter?

   • AThe firewall logs show that the proxy service is on the approved list
   • BThe user has visited a blocked website in the past
   • CThe proxy service is known to be used for legitimate purposes
   • DThe user's browser is configured to use the proxy for all HTTP and HTTPS requests
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A security analyst is reviewing proxy logs and notices that a user is accessing a website that is blocked by the organization's web filter. The user's traffic appears to be coming from a proxy server that is not the organization's proxy. The analyst suspects the user is using a personal proxy to bypass the web filter. Which technique is the user employing?

   • ATunneling the web request through DNS
   • BUsing a VPN to encrypt the web request
   • CEncrypting the web request to hide the destination
   • DUsing a personal proxy to relay the web request
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A security analyst is investigating a malware infection. The malware is using HTTPS to communicate with a C2 server, and the analyst cannot inspect the traffic because it is encrypted. The analyst has access to the firewall logs, which show the traffic going to a known malicious domain. Which action would be most effective in disrupting the malware's communication?

   • AUse a packet capture to inspect the encrypted traffic
   • BBlock the malicious domain on the firewall
   • CEnable TLS decryption on the firewall to inspect the traffic
   • DTrace the proxy chain to identify the C2 server's IP address
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A security analyst is investigating a data exfiltration incident. The analyst has identified that the attacker is using a combination of DNS tunneling and HTTPS to exfiltrate data. The analyst needs to recommend a solution to detect and block this activity. The organization has a firewall that can inspect DNS traffic, but it cannot decrypt HTTPS traffic. Which solution would be most effective?

   • AEnable TLS decryption on the firewall to inspect HTTPS traffic
   • BImplement a web proxy with content filtering to block HTTPS traffic to unknown domains
   • CDeploy a DNS sinkhole to block known malicious domains
   • DMonitor DNS traffic for anomalies and block suspicious domains
   Reveal Solution Discussion Select an answer first