Exam PSE-Strata Topic 1 Question 72 Discussion

DNS sinkholing is a technique used to intercept and redirect malicious traffic to a designated IP address (sinkhole) to identify and prevent further malicious activity. When a compromised host attempts to connect to a known malicious domain, it is instead directed to the sinkhole IP address. This allows security administrators to identify infected hosts by examining traffic logs, where connections to the sinkhole IP address are recorded.
DNS sinkholing does not require a separate license, and the relevant signatures are typically included in the Threat Prevention package.