100-160 Question 23
Select 2A company's IT team detects unusual outbound traffic from multiple employee devices to an unknown external IP address. Upon investigation, they discover that several users received emails impersonating the company's HR department, prompting them to download an attachment labeled 'Updated Benefits Policy.' What type of attack has likely occurred, and what might be the cause of the outbound traffic?
- A
Spear phishing attack leading to malware infection
- B
Distributed Denial of Service (DDoS) attack targeting the company’s servers
- C
Botnet activity initiated by a malicious attachment
- D
Man-in-the-Middle attack on employee devices
- E
Social engineering attack leveraging smishing techniques
Show answer and explanation
Correct answers: A, C
Explanation
The described scenario is consistent with a spear phishing attack where employees were tricked into downloading a malicious attachment. This attachment likely contained malware that infected their devices, causing them to become part of a botnet. The unusual outbound traffic is a hallmark of botnet activity, where compromised devices communicate with a command-and-control server.
- A. Correct.
Correct. A spear phishing attack specifically targets individuals within an organization, often using convincing impersonation tactics. In this case, the HR-themed email was used to deliver malware.
- B. Incorrect.
Incorrect. DDoS attacks involve overwhelming a server or network with traffic. The scenario describes unusual outbound traffic caused by malware, not a direct attack on the company's servers.
- C. Correct.
Correct. The unusual outbound traffic suggests that the devices have been compromised and are now part of a botnet, likely caused by the malicious attachment in the spear phishing email.
- D. Incorrect.
Incorrect. A Man-in-the-Middle attack involves intercepting communication between two parties. There is no indication of intercepted communication in this scenario.
- E. Incorrect.
Incorrect. Smishing uses SMS or text messages for social engineering. The scenario describes an email-based attack, not a text-based one.