CSA (312-39) SOC Simulation Lab

Welcome to the Tier 3 SOC training. In this scenario, you will apply containment and eradication strategies by leveraging DNS controls to neutralize an adversary's malicious infrastructure.

Scenario Context

You are acting as Mark Reynolds, an Incident Response Analyst at a global financial institution. Over the last 4 hours, the SOC detected a massive wave of credential-harvesting phishing emails bypassing the standard mail filter. Several users clicked the links, initiating outbound connections.

The IR team has entered the Eradication phase of the NIST Incident Response lifecycle. The goal is to aggressively neutralize the threat actor's infrastructure across the entire global enterprise, preventing both inbound spam delivery and outbound C2 (Command & Control) beacons before patching the mail gateway.

Security Environment

Reviewing the SIEM dashboard, you observe the following DNS and Web logs tied to the incident:

[08:14:22] DNS_QUERY - Source: 10.50.2.14 - Query: auth-update.malicious-finance-verify.com - Response: 198.51.100.45

[08:14:23] HTTP_PROXY - Source: 10.50.2.14 - Method: POST - URL: http://auth-update.malicious-finance-verify.com/login.php

[08:20:00] SMTP_RELAY - Alert: High volume of inbound emails originating from ASN 64496 (IP: 198.51.100.45)

[08:25:10] IR_TICKET - Task: Neutralize resolution for 198.51.100.45 and associated attacker domains at the core naming service layer.

Question

Mark Reynolds, an SOC analyst at a global financial institution, is working on the eradication phase of an incident response plan after detecting a wave of phishing attacks targeting employees. To ensure attackers cannot reuse their malicious infrastructure, Mark implements a technique that blocks known malicious IP addresses used for sending spam emails at the Domain name system level. Which of the following techniques is best suited for this purpose?

Hint: Look closely at the specific constraint in the prompt: "at the Domain name system level." Which option operates natively at Layer 7 specifically for domain resolution?

Expert Insight

1. What is Happening

The SOC is executing an eradication action. The adversary is using specific domains and IPs (`198.51.100.45`) to orchestrate a phishing campaign. To cut off the attack efficiently across tens of thousands of endpoints, the analyst is intercepting the fundamental internet phonebook: the Domain Name System.

2. Why the Correct Answer is Correct

A. DNS Blackholing is the correct technique. The scenario explicitly states the mitigation must occur at the "Domain name system level." DNS Blackholing (or Sinkholing) intercepts queries for malicious hostnames and returns a null address (e.g., `0.0.0.0`) or redirects the traffic to a safe internal server controlled by the SOC, instantly preventing communication with the attacker's infrastructure.

3. Why Other Options are Wrong

B. SMTP Server Filtering: This operates at the mail gateway. While good for stopping the emails from arriving, it does not operate at the "Domain name system level" and won't stop users who already have the email from clicking the link.

C. URL Blacklisting on Web Proxies: This operates at Layer 7 (HTTP/HTTPS) to block web navigation, but it does not prevent the underlying DNS query from resolving the malicious IP.

D. IP Address Blacklisting at the Firewall: This blocks traffic at Layer 3/4 based on the IP address. While a critical step in IR, it is not an action taken at the DNS level.

4. Real-World SOC Application

In modern SOCs, DNS Blackholing is usually implemented via Response Policy Zones (RPZ) on internal DNS servers (like BIND or Infoblox) or through cloud security providers like Cisco Umbrella. When a high-confidence threat feed flags an IOC, the DNS sinkhole automatically updates, providing enterprise-wide "air cover" in seconds.

MINI LESSON: Defense in Depth (Blocking Layers)

When eradicating an attacker's infrastructure, top-tier analysts block at multiple layers to ensure complete coverage. Understand the distinction of WHERE you block:

DNS Layer (Blackholing/Sinkholing): Prevents the hostname from resolving to an IP. Highly scalable, breaks C2 early.
Network Layer (Firewall ACLs): Drops packets destined for the hardcoded malicious IP. Catches malware that skips DNS.
Application Layer (Proxy/SWG URL Filtering): Blocks specific file paths or URIs (e.g., `/payload.exe`). Best for shared hosting where blocking the IP/Domain would break legitimate services.
Endpoint Layer (EDR Hash Ban): Prevents the execution of the final payload entirely based on file hash or behavior.

Ready to validate your SOC skills further?

Explore more CSA simulations on ExamRange