CND (312-38) Network Defense Simulation

Network Scenario

During routine traffic analysis, your Security Operations Center (SOC) team detects anomalous outbound UDP traffic on Port 53. Standard firewall rules permit this traffic as normal DNS resolution. However, deep packet inspection reveals high-entropy, overly long subdomain strings indicating a potential DNS tunneling attack bypassing current technical controls.

The network defense team determines that the organization's current defense-in-depth strategy is inadequate. They draft a proposal to procure and deploy a dedicated Next-Generation Intrusion Prevention System (NGIPS) and update the enterprise security policy regarding external DNS resolution. This major shift in the Information Security program requires approval from the highest level of information security management.

Traffic & Logs

Question

Expert Analysis

1. What is happening in the network

The logs show an internal endpoint (192.168.45.12) communicating with an external DNS server (8.8.8.8) using TXT record queries containing high-entropy, long subdomain strings. This is a classic signature of DNS Tunneling (e.g., Iodine, DNScat2). The traffic is successfully passing through the firewall because Port 53 (UDP) is explicitly allowed for normal operations.

2. Identify attack or behavior

The attacker is encapsulating malicious C2 (Command and Control) or data exfiltration traffic within standard DNS queries. Because the firewall only checks ports and protocols (not application-layer payload context), the malicious traffic bypasses perimeter defenses.

3. Why the correct answer is correct

CISO (Chief Information Security Officer) is the correct answer. Addressing this vulnerability requires more than a simple firewall rule change; it requires architectural budget (for NGIPS/NGFW), structural policy changes (restricting endpoints to internal DNS servers only), and updating the organization's defense-in-depth posture. The CISO is the top InfoSec officer responsible for maintaining this strategic body of knowledge and authorizing these enterprise-wide security management functions.

4. Why others are wrong

• Network Administrator: Handles the day-to-day operation, routing, and switching. They execute changes but do not dictate enterprise security policy or serve as the top InfoSec officer.
• SOC Manager: Oversees the daily operations of the analysts detecting this threat but typically reports up the chain to the CISO for major budgetary or architectural shifts.
• CTO: Focuses on technological infrastructure and development aligned with business goals, not primarily on information security governance and risk management.

5. Defensive action

To defend against this, the network must be reconfigured so that internal endpoints cannot query external DNS servers directly. Endpoints must query an internal DNS sinkhole/forwarder, which inspects queries for entropy, length, and known bad domains before forwarding them. An IPS should also be configured to drop DNS TXT records exceeding normal length parameters.