SecurityX

Practice session

A threat hunter discovers anomalous outbound connections from a bastion host that correlate with MITRE ATT&CK technique T1572 (Protocol Tunneling). The traffic appears to be DNS queries with unusually large TXT record responses. Which BEST describes the threat and the most effective detection control?

Loading your practice session…