Adversary using multiple domains to avoid detection

312-50v13 By islever Editorial Last updated

Evading IDS, Firewalls, and Honeypots

Short answer

A Unspecified proxy activities involves using multiple domains pointing to the same host to switch quickly and avoid detection.

Question

Clark is a professional hacker. He created and configured multiple domains pointing to the same host to switch quickly between the domains and avoid detection. Identify the behavior of the adversary in the above scenario.
  1. Unspecified proxy activities Correct Answer
  2. Use of command-line interface
  3. Data staging
  4. Use of DNS tunneling

Key Takeaways

The scenario describes using multiple domains to switch quickly and avoid detection, a tactic categorized as unspecified proxy activities rather than data staging or DNS tunneling.

This question tests the identification of evasion techniques where an adversary uses multiple domains pointing to a single host. The correct answer is Unspecified Proxy Activities, which describes obfuscating presence through domain switching.

Common mistake: Many learners select DNS Tunneling (D) because it involves DNS, but DNS tunneling is for exfiltration or command-and-control communication, not for evading detection via domain hopping.

Expert Analysis

Why the Answer Is Correct

The correct answer is A — Unspecified proxy activities. In this scenario, Clark configures multiple domains to point to the same host. This technique allows him to rotate between different URLs while accessing the same backend infrastructure. By doing so, he makes it difficult for defenders to track his activity across a single domain, effectively masking his true actions. This aligns with the definition of unspecified proxy activities used in CEH doctrine to describe obfuscation methods that don't fit standard proxy definitions.

Why the Other Options Are Wrong

B is incorrect because using a CLI is a tool interaction method, not an evasion strategy involving domain configuration. C is incorrect because Data Staging involves copying sensitive data to a temporary location before exfiltration; it does not involve managing multiple domains for anonymity. D is incorrect because DNS Tunneling encodes data within DNS queries for covert communication, whereas the scenario focuses on domain rotation for detection avoidance.

Community Comment Notes

The community majority correctly identified A. As HazalAlenazi noted, "Using multiple domains pointing…" helps mask presence. However, some users like pindinga1 incorrectly chose D, likely confusing the use of DNS with the specific goal of tunneling versus proxy-like evasion.

Exam Strategy

When analyzing evasion tactics, distinguish between the mechanism (e.g., DNS, HTTP) and the intent (e.g., exfiltration vs. anonymity). If the goal is avoiding detection by rotating endpoints, look for terms related to proxies or obfuscation, not just the underlying protocol.

Frequently Asked Questions

Why isn't this DNS Tunneling?

DNS Tunneling is used for covert data transmission or C2 channels. This scenario describes using domains to hide identity/location, which is an evasion/proxy tactic.

What is Data Staging?

Data Staging is the process of collecting stolen data in a temporary directory on a compromised system before final exfiltration. It is unrelated to domain management.

More 312-50v13 FAQ →

Community Votes

A
100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 5 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 5

  1. Stephanie0208 👍 2 Answered A
    Unspecified Proxy Activities An adversary can create and configure multiple domains pointing to the same host, thus, allowing an adversary to switch quickly between the domains to avoid detection. Security professionals can find unspecified domains by checking the data feeds that are generated by those domains. Using this data feed, the security professionals can also find any malicious files downloaded and the unsolicited communication with the outside network based on the domains. ▪ Use of Command-Line Interface On gaining access to the target system, an adversary can make use of the command-line interface to interact with the target system, browse the files, read file content, modify file content, create new accounts, connect to the remote system, and download and install malicious code. Security professionals can identify this behavior of an adversary by checking the logs for process ID, processes having arbitrary letters and numbers, and malicious files downloaded from the Internet.
  2. HazalAlenazi 👍 2 Answered A
    A. Unspecified proxy activities Explanation: In the scenario, Clark is using multiple domains pointing to the same host, likely for the purpose of switching between domains quickly to avoid detection. This behavior aligns with unspecified proxy activities, where the attacker uses various methods to mask their true actions or obfuscate their presence on a network. By using multiple domains pointing to the same host, Clark is trying to avoid detection by security measures that might track a single domain or IP address.
  3. MHafizC 👍 1 Answered A
    A. This is an unspecified proxy activities.
  4. pindinga1 👍 1 Answered D
    DNS tunneling is the correct.
  5. tong0819 👍 1 Answered A
    Answer is A.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Agent-Based vs Network-Based Vulnerability Scanners

S-grade

Network Sniffing Techniques for Penetration Testing

S-grade

File-less Malware Bypassing Application Whitelisting

S-grade

SQL Injection Bypass in Login Forms

S-grade

← Back to 312-50v13 Study Guide