Which Attack Uses DNS Request Patterns for Exfiltration?
Refer to the exhibit. Consider that any feature of DNS requests, such as the length of the domain name and the number of subdomains, can be used to construct models of expected behavior to which observed values can be compared. Which type of malicious attack are these values associated with?
Community Insight
The question tests recognition of DNS-tunneling exfiltration signatures, and the trap is picking HeartBleed or another non-DNS flaw because the exhibit looks like generic traffic data rather than DNS query structure.
This 350-701 question asks which malicious attack is identified by modelling DNS request features such as domain-name length and subdomain count. The page establishes that these behavioral baselines detect DNS tunneling data exfiltration, pointing to the W32/AutoRun worm as the matching option.
Learners commonly choose B, HeartBleed SSL Bug, assuming the exhibit depicts TLS/SSL memory leakage, but HeartBleed involves a malformed heartbeat over-read and has nothing to do with domain length or subdomain counts.
Community Discussion (8 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Building statistical models of expected DNS behavior — measuring domain-name length, label counts, and number of subdomains against an observed query — is the standard detection method for DNS tunneling, which is exactly the exfiltration channel described in objective 6.5. Of the four choices, only the W32/AutoRun worm option describes an attack family that a DNS-behavior model would surface, since the data is encoded into long, unusually deep subdomain chains inside otherwise normal-looking A and TXT lookups. Cisco Talos documented precisely this pattern when detecting DNS data exfiltration, showing queries such as long dash-separated numeric label sequences padded into many subdomains before a catch-all domain. That telemetry is meaningless for memory-disclosure, SMB, or CPU side-channel flaws, so A is the only internally consistent answer.Why the Other Options Are Wrong
B, HeartBleed SSL Bug, is CVE-2014-0160, a buffer over-read in the OpenSSL heartbeat extension that leaks process memory over TLS; it leaves no signature in DNS request structure. C, Eternal Blue, is the MS17-010 SMBv1 kernel exploit used by WannaCry and NotPetya, which is detected through SMB negotiation anomalies rather than subdomain counts. D, Spectre Worm, refers to speculative-execution CPU side channels exploited at the processor level, again with no relationship to domain-name length baselines. None of these three can be flagged by comparing observed DNS values to a model of expected behavior.Community Comment Notes
Arris9 strongly favored A and linked the Talos write-up on DNS data exfiltration, quoting label patterns like "4-9-8-2-2-3-8-5-4-6-2-9-2-3-8-8---redacted---7-.0-0-0-0" to show how tunneled payloads look. loser4fun, tanjiro23, XBfoundX, G33, and CCNP21 all converged on A, with XBfoundX thanking Arris9 because the exhibit is "known as W32/AutoRun Worm." A dissenting voice, Anonymous983475, argued "It's Hearbleed alright" and claimed autorun scripts are obsolete, while west33637 likewise guessed it "Looks like a heartbleed SSL response," but neither addressed the DNS-specific modeling described in the question stem.Official Reference
Exam Strategy
Anchor on the measurement named in the stem: whenever an item mentions domain length, subdomain count, or query entropy, it is testing DNS tunneling exfiltration, not a memory, SMB, or CPU vulnerability. Cross-check each option against its real CVE class and discard any that could not generate DNS-structure anomalies.
Frequently Asked Questions
Why is HeartBleed wrong when the exhibit looks like raw traffic data?
HeartBleed is an OpenSSL heartbeat over-read that leaks memory over TLS, so it produces no DNS domain-length or subdomain-count signature.
What does modeling DNS subdomain counts actually detect?
It detects DNS tunneling, where attackers encode stolen data into long, deeply nested subdomains that deviate from normal query baselines.