How Do You Stop DNS Tunneling for Exfiltration and C2?
What are two recommended approaches to stop DNS tunneling for data exfiltration and command and control call backs? (Choose two.)
Community Insight
This question tests defenses against DNS tunneling and traps candidates into choosing broad NGFW/IPS or blocking all TXT records instead of DNS-layer security and port 53 enforcement.
DNS tunneling hides data exfiltration and command-and-control traffic inside DNS queries, so the page establishes that Cisco Umbrella DNS-layer security plus enforced inspection of port 53 are the two recommended controls.
Candidates often pick an IPS or NGFW because those inspect traffic, but the specific Cisco guidance is to use Umbrella's DNS-layer protection and enforce security over port 53 rather than rely on generic signature inspection or break DNS by blocking TXT records.
Community Discussion (7 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Cisco Umbrella provides DNS-layer security that resolves and inspects DNS requests, blocks malicious or newly seen domains, and applies DNS tunneling and exfiltration detection, directly addressing both data exfiltration and C2 callbacks. Enforcing security over port 53 is the complementary control: organizations must not let DNS traffic bypass inspection or go directly to arbitrary resolvers, because tunneling depends on unrestricted DNS egress. Together, Umbrella and controlled port 53 inspection close the two paths the question asks about. This is why A and E form the intended pair.Why the Other Options Are Wrong
B is plausible but too generic: an NGFW may inspect DNS, yet the question asks for recommended DNS-tunneling approaches, and Cisco's DNS-specific control is Umbrella rather than "use a next-gen firewall" by itself. C is harmful and ineffective: blocking all TXT records breaks legitimate SPF, DKIM, DMARC, and other services, and attackers can tunnel over other record types. D is also broad; an IPS can add signatures, but it does not provide the DNS-layer resolution policy and controlled port 53 enforcement that the Cisco guidance recommends. These options either overblock or rely on generic inspection without the DNS-specific visibility needed for tunneling.Community Comment Notes
jienBoq and Abetong both point to Cisco's Umbrella DNS-tunneling blog and conclude AE, with jienBoq quoting that Umbrella can "predict and prevent DNS tunneling attacks before they happen." XBfoundX calls the question bad but still selects AE, noting that Umbrella secures DNS through policy configuration. Net4dd initially says "AD makes sense" but then links the same Umbrella blog, which supports the Umbrella/port-53 direction. Rododendron2's remark that the exam feels like Cisco portfolio awareness is a fair caution, but it does not change the technical answer.Official Reference
Exam Strategy
When a question mentions DNS tunneling, anchor on DNS-layer visibility and enforcement rather than broad perimeter tools. Eliminate destructive options like blocking all TXT records, and favor answers that name Cisco Umbrella and controlled port 53 DNS inspection.
Frequently Asked Questions
Why is blocking all TXT DNS records not a valid fix for DNS tunneling?
Blocking all TXT records breaks legitimate SPF, DKIM, DMARC, and service discovery, and attackers can still tunnel through A, AAAA, CNAME, or NULL records, so it is neither safe nor sufficient.
Why is an IPS or NGFW not the preferred answer over Umbrella and port 53 enforcement?
Generic IPS or NGFW inspection can help, but Cisco guidance centers on Umbrella DNS-layer security and enforced port 53 policy; broad firewalls alone may miss allowed or encrypted DNS traffic.