Which function is used in a DNS-based responder policy to match any domain containing a substring 'BAD_URL'?

Which function is used in a DNS-based responder policy to match any domain containing a substring 'BAD_URL'?

• A. DNS.REQ.QUESTION.DOMAIN.CONTAINS("BAD_URL")
• B. DNS.REQ.QUESTION.DOMAIN.CONTAINS_ANY("BAD_URL")
• C. DNS.REQ.QUESTION.DOMAIN.EQ("BAD_URL")
• D. DNS.REQ.QUESTION.DOMAIN.STARTS_WITH("BAD_URL")

Answer: (B)

In DNS-based responder policies, you want to detect when the requested domain includes a suspicious substring anywhere in its fully qualified domain name. The function DNS.REQ.QUESTION.DOMAIN.CONTAINS_ANY("BAD_URL") does exactly that: it checks whether the domain in the DNS question contains the substring BAD_URL at any position within the domain string. This means it will match domains like sub.BAD_URL.example.com or BAD_URL.example.org, capturing the substring regardless of where it sits in the name. This is preferable to an exact-match check, which would only match if the domain were exactly BAD_URL, missing all occurrences where BAD_URL appears as part of a larger domain. A starts-with check would miss cases where BAD_URL appears in the middle or end of the domain. The contains-any form is the right pattern for substring matching in this context, and it remains effective even when only a single substring is provided.

In DNS-based responder policies, you want to detect when the requested domain includes a suspicious substring anywhere in its fully qualified domain name. The function DNS.REQ.QUESTION.DOMAIN.CONTAINS_ANY("BAD_URL") does exactly that: it checks whether the domain in the DNS question contains the substring BAD_URL at any position within the domain string. This means it will match domains like sub.BAD_URL.example.com or BAD_URL.example.org, capturing the substring regardless of where it sits in the name.

This is preferable to an exact-match check, which would only match if the domain were exactly BAD_URL, missing all occurrences where BAD_URL appears as part of a larger domain. A starts-with check would miss cases where BAD_URL appears in the middle or end of the domain. The contains-any form is the right pattern for substring matching in this context, and it remains effective even when only a single substring is provided.