Exam SecOps-Pro Topic 1 Question 10 Discussion

DNS tunneling is a sophisticated exfiltration method. A (DNS Sinkholing): While useful for known malicious domains, it's reactive and might not catch novel tunneling. Also, it's a containment measure, not primarily a detection and prevention one for exfiltration content. B (Custom Anti-Spyware + DNS Query Inspection + DNS Security): This is the most comprehensive and accurate approach. Custom Anti-Spyware with DNS Signature enforcement: Can identify known DNS-based malware. DNS Query Inspection: Allows the NGFW to analyze the structure and characteristics of DNS queries, like abnormal length or high entropy (characteristic of encoded data), which are strong indicators of tunneling. DNS Security subscription: Crucially provides advanced analytics (machine learning, behavioral analysis) to detect DGA, tunneling, and other suspicious DNS patterns, even for previously unknown techniques. This combination directly targets the method of exfiltration. C (URL Filtering): Is for HTTP/HTTPS, not directly for DNS exfiltration. D (File Blocking): Too broad and likely to cause false positives and operational disruptions. E (NPB + Third-party SIEM): While useful for deep analysis, it's typically reactive and requires significant manual effort, not providing immediate inline prevention like the NGFW.