An attacker has compromised a number of systems on an organization's network and is exfiltration data Using the Domain Name System (DNS) queries. Which of the following is the BEST mitigation strategy to prevent data exfiltration using this technique? mitigation strategy to prevent data exfiltration using this technique?

Data exfiltration via DNS tunneling encodes data into a series of DNS queries to a malicious domain. The best mitigation is to disrupt this communication channel. A DNS sinkhole intercepts DNS requests for known malicious or non-compliant domains and redirects them to a controlled server. This prevents the malicious queries from ever reaching the attacker's command-and-control (C2) server, effectively blocking the exfiltration path. The sinkhole can also log the source of the queries, providing valuable intelligence for incident response and identifying the compromised internal systems.

A. SSL/TLS encryption (DoT/DoH) for DNS queries hides the content from network inspection but does not stop the malicious query from reaching the attacker's server.
B. A HIDS is a detection control that may identify suspicious activity, but it does not actively block or mitigate the exfiltration itself.
C. Blocking all outbound DNS traffic is not feasible as it would prevent all legitimate internet name resolution, effectively breaking network functionality for users.

1. National Institute of Standards and Technology (NIST). (2021). Special Publication 1800-25, Identifying and Mitigating Botnets and Other Malicious Code. Section 4.2.1.2, "DNS Sinkhole," describes this technique as a primary method to "prevent botnet-infected hosts from communicating with their C2 servers."

2. Dietrich, C. J., & Rossow, C. (2017). On the Evasion of DNS Sinkholes. Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security. https://doi.org/10.1145/3133956.3134016. This paper discusses the mechanics of DNS sinkholing as a defense mechanism against malware communication, including data exfiltration.

3. Carnegie Mellon University. (2010). Best Practices for Preventing and Responding to DNS-Based Attacks. CERT Coordination Center. This document discusses response techniques, including redirecting queries for malicious domains (sinkholing) to prevent communication with attackers.