Which of the following is a limitation of using a DNS sinkhole as a cybersecurity measure? DNS sinkholes are ineffective if the malware uses a public DNS server or its own DNS server DNS sinkholes can prevent malware execution. DNS sinkholes can block all types of malicious traffic. DNS sinkholes can only provide false information for DNS queries.

The correct answer is: **DNS sinkholes are ineffective if the malware uses a public DNS server or its own DNS server.** **Explanation:** A DNS sinkhole works by intercepting DNS queries for known malicious domains and redirecting them to a controlled IP address or null response, effectively preventing malware from reaching its command and control servers. However, if the malware is configured to use a public DNS server (like Google's 8.8.8.8) or its own hard-coded DNS servers, it can bypass the organization's DNS sinkhole. This means the sinkhole would no longer be effective in detecting or blocking the malicious traffic, rendering this security measure less effective in such scenarios. **Why the other options are not correct:** - **DNS sinkholes can prevent malware execution.** - This is actually an advantage, not a limitation. Preventing malware execution is one of the primary benefits of using a DNS sinkhole. - **DNS sinkholes can block all types of malicious traffic.** - This statement is inaccurate because DNS sinkholes specifically target DNS queries related to malicious domains. They do not block all types of malicious traffic, such as non-DNS-based attacks. - **DNS sinkholes can only provide false information for DNS queries.** - While DNS sinkholes do provide alternative responses to DNS queries, this is a feature rather than a limitation. It allows administrators to monitor and control attempts to resolve malicious domains. **Reference:** DNS sinkholes are a valuable tool in cybersecurity for mitigating threats that rely on DNS for communication. However, their effectiveness is contingent on the malware adhering to the expected DNS resolution process within the organization's network. When malware bypasses this by using alternative DNS servers, the sinkhole's ability to intercept and block malicious activity is compromised. **Answer:** DNS sinkholes are ineffective if the malware uses a public DNS server or its own DNS server