What Is the Purpose of a DNS Sinkhole?

SY0-701 By islever Editorial Last updated

Short answer

C A DNS sinkhole can be used to capture traffic to known-malicious domains used by attackers.

Question

Which of the following best describes a use case for a DNS sinkhole?
  1. Attackers can see a DNS sinkhole as a highly valuable resource to identify a company's domain structure.
  2. A DNS sinkhole can be used to draw employees away from known-good websites to malicious ones owned by the attacker.
  3. A DNS sinkhole can be used to capture traffic to known-malicious domains used by attackers. Correct Answer
  4. A DNS sinkhole can be set up to attract potential attackers away from a company's network resources.

Key Takeaways

The exam tests the practical defensive use of DNS sinkholes—intercepting traffic to malicious domains—rather than honeypot or attacker-centric misuse.

A DNS sinkhole is a security control that redirects or captures DNS queries for known-malicious domains, preventing endpoints from reaching harmful sites. Community consensus confirms option C is correct for CompTIA Security+ SY0-701.

Common mistake: Choosing D (attracting attackers away from network resources) is common because it sounds like a honeypot/deception tactic, but a DNS sinkhole is not a decoy; it blocks and redirects outbound DNS requests to malicious domains.

Expert Analysis

Why the Answer Is Correct

A DNS sinkhole works by intercepting DNS queries for known-malicious or unwanted domains and returning a controlled IP address, preventing the client from reaching the actual harmful server. This allows security teams to capture and log traffic attempts to malicious domains, helping detect infected hosts or block malware command-and-control. The suggested answer C aligns with this definition and is universally supported by the community comments.

Why the Other Options Are Wrong

Option A incorrectly describes a DNS sinkhole as a valuable resource for attackers to map domain structure—DNS sinkholes are defensive, not a target for attackers. Option B describes a DNS poisoning or rogue DNS attack, where users are redirected to attacker-controlled malicious sites, which is the opposite of a sinkhole. Option D describes a honeypot or deception technique designed to lure attackers away from network resources, not a DNS-level blocking mechanism.

Community Comment Notes

Comment 1 explains that a DNS sinkhole "intercepts attempts to visit harmful websites and redirects them so you don't end up reaching a malicious website," which directly supports C. Comment 2 notes that the same question appears in Palo Alto Networks PCNSA certification, reinforcing that the concept is foundational across security exams. Comment 3 simply agrees with C and correctly states the sinkhole "redirects malicious or unwanted domain requests to a controlled server, effectively preventing devices from communicating with harmful sites."

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

On the SY0-701 exam, when you see a question about DNS sinkholes, focus on the defensive purpose: blocking and redirecting traffic to known-bad domains. Eliminate options that describe honeypots, DNS poisoning, or attacker-centric benefits—they are the most common distractors.

Community Votes

C
100%

100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. a4e15bd 👍 11
    Answer C is correct DNS sinkhole intercepts attempts to visit harmful websites and redirects them so you don't end up reaching a malicious website and keeps your computer safe.
  2. scoobysnack209 👍 3
    The Answer is C, and also the same question is in Palo Alto Networks PCNSA certification.
  3. TmNvrWts 👍 1 Answered C
    The correct answer is: C. A DNS sinkhole can be used to capture traffic to known-malicious domains used by attackers. A DNS sinkhole is a security mechanism that redirects malicious or unwanted domain requests to a controlled server, effectively preventing devices from communicating with harmful sites.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

CCTV and Surveillance Signs as Security Controls

S-grade

When Should an Engineer Decommission a Network Device?

S-grade

Which Controls Secure Remote Access to Sensitive PHI Applications?

S-grade

Which Zero Trust Component Belongs to the Data Plane?

S-grade

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide