What is another indicator of DNS tunneling?

• A. DNS over HTTPS usage
• B. Abnormally large DNS responses
• C. High volume of DNS queries
• D. Frequent time-based DNS query bursts

Answer: (C)

DNS tunneling creates data flow by issuing many DNS queries, so an unusually high volume of DNS queries is a strong indicator. When data is encoded in subdomain lookups, the traffic rate can rise well above normal client activity and persist across multiple destinations, signaling a covert channel using DNS. Other signs like DNS over HTTPS or unusually large responses can occur in various contexts, and bursts of queries can have legitimate causes, but they don’t pinpoint tunneling as clearly as a sustained spike in query volume.