Adversary using multiple domains to avoid detection
Clark is a professional hacker. He created and configured multiple domains pointing to the same host to switch quickly between the domains and avoid detection. Identify the behavior of the adversary in the above scenario.
Community Votes
100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The scenario describes using multiple domains to switch quickly and avoid detection, a tactic categorized as unspecified proxy activities rather than data staging or DNS tunneling.
This question tests the identification of evasion techniques where an adversary uses multiple domains pointing to a single host. The correct answer is Unspecified Proxy Activities, which describes obfuscating presence through domain switching.
Many learners select DNS Tunneling (D) because it involves DNS, but DNS tunneling is for exfiltration or command-and-control communication, not for evading detection via domain hopping.
Community Discussion (5 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The correct answer is A — Unspecified proxy activities. In this scenario, Clark configures multiple domains to point to the same host. This technique allows him to rotate between different URLs while accessing the same backend infrastructure. By doing so, he makes it difficult for defenders to track his activity across a single domain, effectively masking his true actions. This aligns with the definition of unspecified proxy activities used in CEH doctrine to describe obfuscation methods that don't fit standard proxy definitions.Why the Other Options Are Wrong
B is incorrect because using a CLI is a tool interaction method, not an evasion strategy involving domain configuration. C is incorrect because Data Staging involves copying sensitive data to a temporary location before exfiltration; it does not involve managing multiple domains for anonymity. D is incorrect because DNS Tunneling encodes data within DNS queries for covert communication, whereas the scenario focuses on domain rotation for detection avoidance.Community Comment Notes
The community majority correctly identified A. As HazalAlenazi noted, "Using multiple domains pointing…" helps mask presence. However, some users like pindinga1 incorrectly chose D, likely confusing the use of DNS with the specific goal of tunneling versus proxy-like evasion.Exam Strategy
When analyzing evasion tactics, distinguish between the mechanism (e.g., DNS, HTTP) and the intent (e.g., exfiltration vs. anonymity). If the goal is avoiding detection by rotating endpoints, look for terms related to proxies or obfuscation, not just the underlying protocol.
Frequently Asked Questions
Why isn't this DNS Tunneling?
DNS Tunneling is used for covert data transmission or C2 channels. This scenario describes using domains to hide identity/location, which is an evasion/proxy tactic.
What is Data Staging?
Data Staging is the process of collecting stolen data in a temporary directory on a compromised system before final exfiltration. It is unrelated to domain management.