Which security measure uses a temporary DNS record to route malicious traffic to a controlled IP?

Which security measure uses a temporary DNS record to route malicious traffic to a controlled IP?

• A. DNS sinkhole
• B. Firewall
• C. Honeypot
• D. VPN

Answer: (A)

DNS sinkholing redirects traffic destined for known malicious domains to a controlled IP by using temporary DNS records. When a malware-infected device requests a bad domain, the DNS response points to a sinkhole address instead of the real destination, allowing defenders to monitor, log, or block that traffic and, if desired, serve safe content. This technique relies on manipulating DNS responses to route suspicious activity to an environment you control, making it possible to study and neutralize threats without letting them reach their actual servers. Other options don’t fit: a firewall blocks or filters traffic but doesn’t reroute DNS queries to a controlled host; a honeypot is a decoy system to attract attackers rather than reroute DNS to monitor malicious requests; a VPN creates an encrypted tunnel for legitimate access, not redirection of malicious traffic via DNS.

DNS sinkholing redirects traffic destined for known malicious domains to a controlled IP by using temporary DNS records. When a malware-infected device requests a bad domain, the DNS response points to a sinkhole address instead of the real destination, allowing defenders to monitor, log, or block that traffic and, if desired, serve safe content. This technique relies on manipulating DNS responses to route suspicious activity to an environment you control, making it possible to study and neutralize threats without letting them reach their actual servers. Other options don’t fit: a firewall blocks or filters traffic but doesn’t reroute DNS queries to a controlled host; a honeypot is a decoy system to attract attackers rather than reroute DNS to monitor malicious requests; a VPN creates an encrypted tunnel for legitimate access, not redirection of malicious traffic via DNS.