DNS tunneling vs DGA vs fast flux

Key: D

1. AVulnerability scans and patch status describe exposure but cannot say which process made the suspicious lookups or where they led.
2. BEmail headers and registry keys have no link to the DNS pattern, so this pivot chain drifts away from the evidence.
3. CAsset inventory and backup logs describe the host, but they do not trace the lookups to a process or to attacker infrastructure.
4. DCorrect: Pivoting from the process that made the queries to its DNS history and then enriching the resolved IPs ties the NXDOMAIN burst, typical of DGA malware, to the responsible binary and the C2 infrastructure it reached.

Key: A

1. ACorrect: High entropy in domain names combined with many unique, never-seen names is what sets DGA traffic apart, and requiring both signals keeps noise from legitimate random-looking names down.
2. BQuery volume alone is noisy, because busy hosts and normal applications also generate many DNS queries.
3. CShort TTLs are common on CDNs and point toward fast-flux rather than DGA, so alerting on all of them floods analysts.
4. DByte counts from one host suggest data transfer or tunneling, which is a different signal from algorithmically generated domain names.

Key: B

1. ANormal resolution uses short names and small A or AAAA answers instead of repeated TXT queries of about 190 characters with large replies.
2. BCorrect: Long query names, large TXT responses, a steady 30-second rhythm and an unknown process all point to data tunneled through DNS, so the process and the domain should be dealt with.
3. CNTP runs over UDP port 123 and never travels inside DNS TXT queries.
4. DA misconfigured forwarder causes failures or loops for many clients, whereas here one unknown process sends long, regular TXT queries.

Key: D

1. ASlow exfiltration moves data in small pieces, so looking only for large file transfers in proxy logs is exactly how this channel slips past.
2. BA 30-day byte total blurs a low-and-slow channel into normal traffic and does not tie the uploads to the encoded DNS names.
3. CAlerting on every DNS query from VPN hosts floods the queue with noise and does not test whether these encoded subdomains carry data.
4. DCorrect: lining up DNS and proxy timestamps for the same encoded domains ties the two weak signals to one channel and separates covert exfiltration from ordinary periodic traffic.

Key: C

1. ANeither HostY nor HostZ shows the DGA signature: both have few unique queries and low NXDOMAIN rates.
2. BHostY makes only nine unique queries with an 8 percent NXDOMAIN rate, which is ordinary resolver behavior.
3. CCorrect: HostX queries many unique names and most of them fail with NXDOMAIN, the pattern of malware cycling through generated domains until it finds the few the operator registered.
4. DHostZ resolves to many IPs, but with few unique queries and almost no NXDOMAIN responses, that looks more like a load-balanced or CDN-hosted service than a DGA.

Key: B

1. ACDNs also serve from IP addresses around the world, so geographic spread alone cannot tell fast-flux from a CDN.
2. BCorrect: Very short TTLs on a domain registered only days ago is a strong fast-flux signal, because CDNs run on long-established domains.
3. CMany queries from internal hosts show the domain is popular and prove nothing about infrastructure rotating like fast-flux.
4. DLarge CDNs also return many different IPs, so the count alone does not separate them from fast-flux networks.

Key: C

1. ANXDOMAIN bursts point to DGA activity, while fast-flux domains resolve successfully, just to constantly changing IPs.
2. BQuery counts per host measure how busy a client is and cannot show whether a domain's answers keep rotating.
3. CCorrect: Fast-flux shows up as one domain resolving to many distinct IPs in a short time, so counting distinct answers per domain over a window catches it directly.
4. DExact matches against known bad domains miss new fast-flux domains, while the rotation pattern catches them.