350-201 Question 208
Single answerA network security team is using a Cisco AI-based predictive analysis tool that monitors traffic patterns for anomalies. The tool has flagged a potential attack sequence. The team notices an unusual spike in DNS requests from a single internal IP address, followed by large outbound data transfers to an external server. Based on the sequence of events, what type of attack is most likely occurring?
- A
DNS Tunneling
- B
Distributed Denial-of-Service (DDoS)
- C
Man-in-the-Middle (MITM)
- D
Phishing
Show answer and explanation
Correct answer: A
Explanation
The unusual spike in DNS requests followed by outbound data transfers is a strong indicator of DNS Tunneling. Predictive AI tools can identify such patterns, suggesting that the attacker is using DNS to covertly exfiltrate data or communicate with a command-and-control (C2) server. This aligns with the described sequence of events, making DNS Tunneling the most likely attack type.
- A. Correct.
DNS Tunneling is a technique often used by attackers to exfiltrate data or establish a communication channel by embedding data inside DNS queries and responses. The spike in DNS requests and subsequent outbound data transfer aligns with this attack pattern.
- B. Incorrect.
DDoS attacks typically involve overwhelming a target system or network with a high volume of traffic from multiple sources. This scenario does not describe such distributed traffic behavior.
- C. Incorrect.
Man-in-the-Middle attacks involve intercepting and altering communication between two parties, which is not indicated by the sequence of events described in the scenario.
- D. Incorrect.
Phishing attacks are social engineering tactics aimed at tricking users into revealing sensitive information. This scenario does not involve user interaction or social engineering tactics.