Skip to content
AI Security

Interview question · Network Security & Protocols

How does a subdomain takeover happen through dangling DNS, and how would you prevent and detect it across hundreds of cloud resources?

Nobody attacks your DNS; they just claim the cloud resource your DNS still points at. The scored answer explains why it is so common and how to stop it at deprovisioning.

mediumNewPreparation tags: Microsoft, Amazon, CloudflareUpdated Nov 2026

Nobody attacks your DNS; they just claim the cloud resource your DNS still points at. The scored answer explains why it is so common and how to stop it at deprovisioning.

Make your first attempt

What would you say before reading the answer?

  1. 01 State the assumptions your answer depends on.
  2. 02 Explain the mechanism and choose a control.
  3. 03 Name a condition that would change your decision.

The worked answer includes an approach, scoring criteria and follow-up questions. Compare the reasoning with your own.

10 answers per topic instead of 5, plus saved progress and bookmarks · costs nothingor unlock all 529 remaining answers · $25

Every worked answer in all 17 topics, every lesson in every course, the full concept curriculum, the complete practice-test bank, and the downloadable security field guides.

6 months · One payment · No auto-renewal

What if · the follow-ups in this answer

The answer works through 4 follow-ups like an interviewer would

Certificate transparency monitoring alerts on a newly issued certificate for old-campaign.example.com, which nobody on the web team recognises. The subdomain now serves a login page styled like the company's single sign-on.

  1. What is the first thing you check?
  2. How do you contain it?
  3. What else could the attacker have done with that subdomain?
  4. What process change prevents the next one?

Each rung has a nudge, a model answer, the principle that carries over and the weak answer to avoid. Premium opens every answer and ladder.

UP NEXT ON YOUR JOURNEY
Next in this trackDMARC is at reject, yet phishing still arrives. How do email gateways and API-based filters stop what sender authentication cannot?Next in this trackAn acquired company has an unknown public portal. What do you do before integrating its environment?Popular right nowWhat security risks does the Model Context Protocol (MCP) introduce?
DISCUSSION · 0

No comments yet. Share a correction or a different way to answer it.