100-160 Question 21
Single answerA company’s IT team notices unusual outbound traffic from several devices on the network. Upon investigation, they find that these devices are communicating with an unknown server and are part of a coordinated attack to overwhelm a target system. What type of threat is the company dealing with?
- A
Advanced Persistent Threat (APT)
- B
Botnet
- C
Man-in-the-Middle (MitM) attack
- D
Ransomware
Show answer and explanation
Correct answer: B
Explanation
The company is dealing with a botnet, which is a network of devices that have been compromised and are under the control of an attacker. These devices are often used to perform coordinated malicious activities, such as Distributed Denial of Service (DDoS) attacks. The unusual outbound traffic and communication with an unknown server are key indicators of botnet activity.
- A. Incorrect.
An Advanced Persistent Threat (APT) involves a prolonged and stealthy attack by a threat actor, often with the goal of stealing sensitive data or espionage, rather than coordinating an attack using multiple devices.
- B. Correct.
A botnet consists of a network of compromised devices (bots) controlled by an attacker to perform malicious activities such as Distributed Denial of Service (DDoS) attacks, spam campaigns, or data theft. The scenario described matches this definition.
- C. Incorrect.
A Man-in-the-Middle (MitM) attack involves an attacker intercepting and possibly altering communications between two parties, which is unrelated to the coordinated attack described in the scenario.
- D. Incorrect.
Ransomware is a type of malware that encrypts data and demands payment from the victim to regain access. While serious, this does not align with the scenario of devices being used in a coordinated attack.