How Do You Stop DNS Tunneling for Exfiltration and C2?

350-701 By islever Editorial Last updated

Explain exfiltration techniques such as DNS tunneling, HTTPS, email, FTP/SSH/SCP/SFTP, ICMP, Messenger, IRC, NTP, and cloud storage

Short answer

AE Use Cisco Umbrella DNS-layer security to block tunneling domains and enforce DNS inspection over port 53 so tunneled queries cannot bypass policy.

Question

What are two recommended approaches to stop DNS tunneling for data exfiltration and command and control call backs? (Choose two.)
  1. Use Cisco Umbrella Correct Answer
  2. Use next generation firewalls.
  3. Block all 'TXT' DNS records.
  4. Use intrusion prevention system.
  5. Enforce security over port 53. Correct Answer

Key Takeaways

This question tests defenses against DNS tunneling and traps candidates into choosing broad NGFW/IPS or blocking all TXT records instead of DNS-layer security and port 53 enforcement.

DNS tunneling hides data exfiltration and command-and-control traffic inside DNS queries, so the page establishes that Cisco Umbrella DNS-layer security plus enforced inspection of port 53 are the two recommended controls.

Common mistake: Candidates often pick an IPS or NGFW because those inspect traffic, but the specific Cisco guidance is to use Umbrella's DNS-layer protection and enforce security over port 53 rather than rely on generic signature inspection or break DNS by blocking TXT records.

Expert Analysis

Why the Answer Is Correct

Cisco Umbrella provides DNS-layer security that resolves and inspects DNS requests, blocks malicious or newly seen domains, and applies DNS tunneling and exfiltration detection, directly addressing both data exfiltration and C2 callbacks. Enforcing security over port 53 is the complementary control: organizations must not let DNS traffic bypass inspection or go directly to arbitrary resolvers, because tunneling depends on unrestricted DNS egress. Together, Umbrella and controlled port 53 inspection close the two paths the question asks about. This is why A and E form the intended pair.

Why the Other Options Are Wrong

B is plausible but too generic: an NGFW may inspect DNS, yet the question asks for recommended DNS-tunneling approaches, and Cisco's DNS-specific control is Umbrella rather than "use a next-gen firewall" by itself. C is harmful and ineffective: blocking all TXT records breaks legitimate SPF, DKIM, DMARC, and other services, and attackers can tunnel over other record types. D is also broad; an IPS can add signatures, but it does not provide the DNS-layer resolution policy and controlled port 53 enforcement that the Cisco guidance recommends. These options either overblock or rely on generic inspection without the DNS-specific visibility needed for tunneling.

Community Comment Notes

jienBoq and Abetong both point to Cisco's Umbrella DNS-tunneling blog and conclude AE, with jienBoq quoting that Umbrella can "predict and prevent DNS tunneling attacks before they happen." XBfoundX calls the question bad but still selects AE, noting that Umbrella secures DNS through policy configuration. Net4dd initially says "AD makes sense" but then links the same Umbrella blog, which supports the Umbrella/port-53 direction. Rododendron2's remark that the exam feels like Cisco portfolio awareness is a fair caution, but it does not change the technical answer.

Official Reference

https://umbrella.cisco.com/blog/improvements-dns-tunneling-dns-exfiltration-detection

This link opens the official vendor documentation in a new tab.

Exam Strategy

When a question mentions DNS tunneling, anchor on DNS-layer visibility and enforcement rather than broad perimeter tools. Eliminate destructive options like blocking all TXT records, and favor answers that name Cisco Umbrella and controlled port 53 DNS inspection.

Frequently Asked Questions

Why is blocking all TXT DNS records not a valid fix for DNS tunneling?

Blocking all TXT records breaks legitimate SPF, DKIM, DMARC, and service discovery, and attackers can still tunnel through A, AAAA, CNAME, or NULL records, so it is neither safe nor sufficient.

Why is an IPS or NGFW not the preferred answer over Umbrella and port 53 enforcement?

Generic IPS or NGFW inspection can help, but Cisco guidance centers on Umbrella DNS-layer security and enforced port 53 policy; broad firewalls alone may miss allowed or encrypted DNS traffic.

More 350-701 FAQ →

Discussion 7 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 7

  1. jienBoq 👍 4
    Take DNS-Layer Security to the Next Level Cisco Umbrella analyzes internet activity to uncover known and emergent threats in order to protect users anywhere they go. Together, these capabilities power Umbrella to predict and prevent DNS tunneling attacks before they happen. Enabling this security category reduces the risk of DNS tunneling and potential data loss. Organizations can choose to block users from using DNS tunneling VPN services, or they can monitor the results in reports, providing flexibility to determine what is suitable given their risk tolerance. Address your DNS blind spot by enforcing security over port 53 both on and off the corporate network. Request a personalized demo of Cisco Umbrella today to explore how this exciting new feature can help protect your enterprise. https://umbrella.cisco.com/blog/improvements-dns-tunneling-dns-exfiltration-detection
  2. Abetong 👍 3
    From the link you sent AE is the correct answer.
  3. Net4dd 👍 2
    AD makes sense
  4. XBfoundX 👍 1
    This question is really bad... I would day anyway that the answer for sure is A and E looking at the blog... but using Umbrella already is gonna secure DNS, just configure the DNS Policies... Anyway answer seems to be the following...
  5. Silexis 👍 1
    You are correct. I suspect they are shifting towards AI so the real security knowledge will be embedded in it and we, humans, will become only pre-sales with some devops programming skills
Show 2 more comments
  1. Rododendron2 👍 1
    Going via questions ... The exam is becoming more Cisco marketing portfolio awareness then some real security knowledge
  2. Net4dd 👍 1
    https://umbrella.cisco.com/blog/improvements-dns-tunneling-dns-exfiltration-detection

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

What Is a Feature of an Endpoint Detection and Response Solution?

S-grade

Which Two Methods Belong in an AAA Authentication Method List?

S-grade

Preventing Unauthorized DHCP Servers on Cisco Switches

S-grade

What Is Considered a Cloud Data Breach in Cisco 350-701?

S-grade

← Back to 350-701 Study Guide