What Is the Purpose of a DNS Sinkhole?

Why the Answer Is Correct

A DNS sinkhole works by intercepting DNS queries for known-malicious or unwanted domains and returning a controlled IP address, preventing the client from reaching the actual harmful server. This allows security teams to capture and log traffic attempts to malicious domains, helping detect infected hosts or block malware command-and-control. The suggested answer C aligns with this definition and is universally supported by the community comments.

Why the Other Options Are Wrong

Option A incorrectly describes a DNS sinkhole as a valuable resource for attackers to map domain structure—DNS sinkholes are defensive, not a target for attackers. Option B describes a DNS poisoning or rogue DNS attack, where users are redirected to attacker-controlled malicious sites, which is the opposite of a sinkhole. Option D describes a honeypot or deception technique designed to lure attackers away from network resources, not a DNS-level blocking mechanism.

Community Comment Notes

Comment 1 explains that a DNS sinkhole "intercepts attempts to visit harmful websites and redirects them so you don't end up reaching a malicious website," which directly supports C. Comment 2 notes that the same question appears in Palo Alto Networks PCNSA certification, reinforcing that the concept is foundational across security exams. Comment 3 simply agrees with C and correctly states the sinkhole "redirects malicious or unwanted domain requests to a controlled server, effectively preventing devices from communicating with harmful sites."