What is the purpose of a DNS sinkhole in security?

• A. Provide false information to malicious software to redirect queries to remediation
• B. Block all DNS queries
• C. Encrypt DNS traffic
• D. Speed up DNS resolution

Answer: (A)

The main idea behind a DNS sinkhole is to trap and neutralize malware by using DNS responses to misdirect requests. When a device on the network tries to reach domains known to be controlled by attackers or used for malware communications, the sinkhole provides a false or controlled IP address instead of the real destination. This keeps the malware from connecting to its command-and-control servers or update sites, and it also lets security teams monitor who is contacting those malicious domains and guide infected machines to remediation steps. In short, it uses misleading DNS information to derail malicious activity and enable defense and remediation.

Two other options miss the mark because they describe different goals. Encrypting DNS traffic protects privacy and integrity of DNS queries, not redirecting or trapping malware. Blocking all DNS queries would cripple regular internet access, whereas a sinkhole focuses on specific malicious domains. And speeding up DNS resolution is about performance, not security-focused redirection or remediation.