A security analyst wants to create a NIDS rule to detect when anomalous DNS traffic takes place on the network. Which of the following items should the analyst take into consideration? (Select TWO).
A DNS uses TCP over port 53.
B DNS Traffic must be decrypted before being inspected.
C UDP queries are usually bigger than 1024 bytes.
D Zone transfers are public and can be accepted from any source.
E Zone transfers should only be sent to approved destinations.
Answer : The analyst must take B and E options into consideration when the anomalous DNS traffic takes place on the network.
Explanation:
I have selected option B because all encrypted DNS traffic must be decrypted before being inspected and option E because zone tranfers should only be sent to approved destinations as we can't send to unapproved destinations. Remaining options are not related to the question asked.
A security analyst wants to create a NIDS rule to detect when anomalous DNS traffic takes...