During a red team engagement at a biotechnology firm in San Diego, California, the security...

The correct answer is C. DNS Tunneling.

The scenario describes encoded data hidden inside outbound DNS query strings and sent to attacker-controlled external servers. This is the defining behavior of DNS tunneling, where DNS traffic is abused as a covert channel for command-and-control or data exfiltration.

CEH-aligned covert-channel material explains that tunneling allows one protocol to be carried over another protocol and that covert channels can hide data inside otherwise permitted traffic. It also notes that DNS query and reply traffic may be used to tunnel commands or data so that traffic appears ordinary to protocol analyzers .

Option A. TCP Parameter Manipulation is incorrect because the scenario does not describe hiding data in TCP header fields.

Option B. Reverse ICMP Tunnel is incorrect because the suspicious traffic is DNS name resolution traffic, not ICMP echo traffic.

Option D. Reverse HTTP Shell is incorrect because the activity is not HTTP/HTTPS-based command retrieval.

Therefore, the best answer is C. DNS Tunneling.