Certified Ethical Hacker (CEH) Practice Question

Regular, fixed-size TXT queries that carry base64 data strongly suggest DNS tunneling. Mature APT groups often rely on this channel once inside the network to quietly move stolen information past perimeter controls. To verify that the channel is being used for exfiltration, you would examine the volume, size and decoded content of the outbound TXT payloads. The other options describe activities (initial spear-phishing, Kerberos abuse for privilege escalation, lateral SMB movement) that would not normally rely on repetitive TXT traffic to an external domain.