Câu 46: 312-39V2: Certified SOC Analyst (CSA) v2

DNS logs in the SIEM show an internal host sending many DNS queries with long, encoded subdomains to an external domain. The queries predominantly use TXT records and occur during off-business hours. The external domain is newly registered and has no known business association. Which of the following best explains this behaviour?

1. A. Monitoring DNS cache poisoning attempts
2. B. Detecting rogue DNS servers within the internal network
3. C. Validating DNS records for legitimate business operations
4. D. Identifying DNS tunneling for data exfiltration — đáp án hiện tại