Cert Master

KT-NET Port anomalies

Netflow shows micro-bursts on port 53 to many external IPs. Consider?

Multiple choice — select one answer

Answer choices

  1. a. Possible DNS tunneling exfiltration—inspect query entropy and destinations
  2. b. Badge reader maintenance, without security or identity team coordination per policy.
  3. c. Normal email delivery, without security or identity team coordination per policy.
  4. d. Patch Tuesday only, without security or identity team coordination per policy.

Architectural breakdown & explanation

Anomalous DNS volume/entropy can indicate tunneling.

Correct answer(s): a. Possible DNS tunneling exfiltration—inspect query entropy and destinations

Exam domain: Port anomalies (17% weight on the official guide).

Official documentation & study links

Practice this certification

This page is one question from the KeyTrain's Key Training — Network Security bank. Run a full timed practice exam with domain-weighted random questions in your browser.

Start practice exam View exam overview All certifications