Cisco CyberOps Associate (CBROPS) 200-201Network Intrusion AnalysisMedium
A security operations center (SOC) analyst observes unusual outbound network connections from an internal server to an external IP address on TCP port 53. The internal server is not configured to perform DNS resolution for external clients, and the traffic volume is significantly higher than normal DNS queries. What is the most likely initial conclusion regarding this activity?
- AThe server is infected with malware using DNS for command and control (C2).
- BThe server is performing legitimate, but misconfigured, DNS resolution.
- CThe server is participating in a distributed denial-of-service (DDoS) attack.
- DA network administrator is conducting routine DNS server maintenance.
Show answer & explanationAnswer & explanation
Correct answer: A. The server is infected with malware using DNS for command and control (C2).
Malware often uses DNS over TCP port 53 for command and control (C2) communications, especially when normal outbound ports are blocked, as DNS traffic is frequently allowed through firewalls. High volume and unusual destinations are strong indicators.
Why the other options are wrong
- B. While misconfiguration is possible, the 'unusual outbound' and 'significantly higher volume' point more strongly to malicious activity.
- C. While possible, participating in a DDoS attack usually involves sending a flood of traffic, often on various ports or to specific targets, not typically characterized by C2-like DNS traffic on port 53 from a single internal server.
- D. Maintenance typically involves known-good servers and expected traffic patterns, not unusual outbound connections to unknown external IPs.
DNS Tunneling
A technique used by attackers to encapsulate data within DNS queries and responses, often for command and control (C2) communications or data exfiltration, to bypass firewalls that typically allow DNS traffic.
- Uses TCP/UDP port 53
- Can be used for C2 or data exfiltration
- Often characterized by unusual DNS query patterns or sizes
Memory trick: Malware Masks as Normal: C2, Exfil, Scan, DDoS.