Cisco CyberOps Associate (CBROPS) 200-201Security MonitoringHard
A security analyst is reviewing a full packet capture (PCAP) file from a suspected data exfiltration incident. The analyst observes numerous small DNS query packets where the requested domain names appear to be unusually long and contain seemingly random alphanumeric strings, such as 'd29ybGRfZGF0YS50eHQ.attacker.com'. What technique is most likely being used for data exfiltration?
- ADNS exfiltration
- BSMB file transfer
- CICMP tunneling
- DHTTP tunneling
Show answer & explanationAnswer & explanation
Correct answer: A. DNS exfiltration
The observation of 'numerous small DNS query packets' with 'unusually long and contain seemingly random alphanumeric strings' in the requested domain names (e.g., 'd29ybGRfZGF0YS50eHQ.attacker.com') is a classic indicator of DNS exfiltration. In this technique, sensitive data is encoded (often Base64, as 'd29ybGRfZGF0YS50eHQ' appears to be) and embedded within DNS queries, which are then sent to an attacker-controlled DNS server.
Why the other options are wrong
- B. SMB file transfer would use SMB protocol (ports 445/139) for file sharing, not DNS queries, and is typically for local network file transfers, not covert exfiltration via DNS.
- C. ICMP tunneling would embed data within ICMP echo requests/replies, not DNS query packets.
- D. HTTP tunneling would involve HTTP requests with encoded data, typically on ports 80 or 443, not DNS queries.
DNS Exfiltration
A type of data exfiltration that encodes sensitive data within DNS queries or responses, sending it to an attacker-controlled DNS server to bypass firewalls and intrusion detection systems.
- Leverages the DNS protocol (UDP port 53).
- Data is often Base64 encoded and embedded in subdomain names.
- Characterized by unusually long, malformed, or numerous DNS queries.
- Difficult to detect without deep packet inspection or DNS anomaly detection.
Memory trick: Data trying to sneak out, hidden in plain sight, using common services.