A security administrator has completed a monthly review of DNS server query logs. The administrator notices continuous name resolution attempts from a large number of internal hosts to a single Internet addressable domain name. The security administrator then correlated those logs with the establishment of persistent TCP connections out to this domain. The connections seem to be carrying on the order of kilobytes of data per week. Which of the following is the MOST likely explanation for this anomaly?

Question

Quizplus · Accepted Answer

The persistent connections and data transfer to a single domain suggest that internal hosts are likely part of a botnet, which often involves communication with a command and control server.

A Security Administrator Has Completed a Monthly Review of DNS