100-160 Question 22
Single answerA financial services company has detected unusual outbound traffic from an employee's workstation. Further investigation reveals that the workstation is communicating with a suspicious external server and sending encrypted data at regular intervals. What type of cybersecurity threat is most likely affecting this workstation?
- A
Ransomware
- B
Man-in-the-middle attack
- C
Botnet activity
- D
Advanced Persistent Threat (APT)
Show answer and explanation
Correct answer: D
Explanation
The scenario describes a workstation communicating with a suspicious external server and sending encrypted data at regular intervals, which is a hallmark of an Advanced Persistent Threat (APT). APTs are sophisticated attacks designed to remain undetected while exfiltrating sensitive information over time. Unlike ransomware or botnet activity, APTs are targeted and prolonged, making them the most likely threat in this case.
- A. Incorrect.
Ransomware typically involves encrypting files on a victim's system and demanding a ransom payment for decryption. There is no indication of file encryption or ransom demands in this scenario.
- B. Incorrect.
A man-in-the-middle attack involves intercepting and potentially altering communications between two parties. This scenario does not include evidence of intercepted communications.
- C. Incorrect.
Botnet activity involves a network of compromised devices being controlled remotely to perform malicious actions, such as launching denial-of-service attacks. While the workstation is communicating with an external server, the behavior described does not align with typical botnet activity.
- D. Correct.
Advanced Persistent Threat (APT) refers to a prolonged and targeted cyberattack where an adversary gains unauthorized access to a network and remains undetected to steal sensitive data. The encrypted data being sent to an external server at regular intervals suggests APT activity.