Explain how you would use log analysis to detect DNS tunneling or DNS exfiltration. What specific patterns would you look for in DNS logs, and what makes this type of attack difficult to detect?

Sample answer preview

DNS tunneling is a technique where an attacker uses DNS queries and responses to smuggle data in and out of a network. Since DNS traffic is almost universally allowed through firewalls and often receives minimal scrutiny from security tools, it provides a covert channel that can…