What category covers adversaries creating and configuring multiple domains that point to the same host to switch between domains and evade detection?

• A. Internal Reconnaissance
• B. Use of PowerShell
• C. Unspecified Proxy Activities
• D. Use of Domain Redirects

Answer: (C)

This item tests how attackers hide activity by using a network proxy-like approach with domain manipulation. By registering several domains that all point to the same host, an adversary can rotate which domain is used for communication or C2. If one domain gets blocked or flagged, they switch to another that reaches the same server, effectively using the domains as interchangeable intermediaries. This behavior fits the idea of proxy activities—using alternate network addresses to route traffic and obscure origin or intent—so it’s categorized as unspecified proxy activities in this framework. Internal reconnaissance and PowerShell use focus on different behaviors (information gathering and tool usage, respectively), while domain redirects describe a more specific redirect mechanism, not the broader evasion technique of rotating domains to proxy traffic.