A DNS log shows one endpoint issuing many long, high-entropy subdomain queries to one newly observed domain. Which hypothesis should be investigated?

1. A successful software update with no need for validation
2. Normal behavior solely because DNS is permitted
3. A confirmed disk controller failure
4. Possible DNS tunneling or exfiltration