An administrator received a FortiAnalyzer alert that a 1 disk filled up in a day. Upon investigation, they found thousands of unusual DNS log requests, such as JHCMQK.website.com, with no answers. They later discovered that DNS exfiltration was occurring through both UDP and TLS.
How can the administrator prevent this data theft technique?
Show Answer
Hide Answer
Correct Answer:
D
The excessive DNS log requests with random subdomains suggest a DNS exfiltration attack, where attackers encode and transmit data via DNS queries. Since this technique can use both UDP and TLS (DoH - DNS over HTTPS), a comprehensive security approach is needed.
Using an IPS profile with DNS exfiltration-specific signatures allows FortiGate to:
Detect and block abnormal DNS query patterns often used in exfiltration.
Inspect encrypted DNS (DoH, DoT) traffic if SSL inspection is enabled.
Identify known exfiltration domains and techniques based on FortiGuard threat intelligence.
