200-201 Question 121
Single answerYou are an analyst in a SOC (Security Operations Center) investigating unusual traffic on your organization's network. You discover that a specific endpoint is generating encrypted traffic over non-standard ports and connecting to multiple IP addresses across the globe. Further analysis reveals that the traffic is associated with The Onion Router (TOR). What is the most likely reason for this behavior?
- A
The endpoint is using TOR for legitimate anonymous browsing.
- B
The endpoint is infected with malware using TOR to communicate with its command-and-control server.
- C
The endpoint is scanning the network for vulnerabilities using TOR to mask its activity.
- D
The endpoint is misconfigured and mistakenly routing internal traffic through TOR nodes.
Show answer and explanation
Correct answer: B
Explanation
The described behavior indicates the endpoint is likely compromised and using TOR to communicate with a command-and-control server. This is a common tactic employed by malware to evade network monitoring and maintain anonymity.
- A. Incorrect.
While TOR can be used for legitimate anonymous browsing, this scenario describes unusual and suspicious behavior, making this option less likely.
- B. Correct.
Malware often uses TOR to hide its communication with command-and-control servers, which matches the described behavior of encrypted traffic over non-standard ports and global connections.
- C. Incorrect.
While TOR could be used to mask scanning activity, the scenario does not provide evidence of internal network scanning, making this option incorrect.
- D. Incorrect.
A misconfiguration could lead to unintentional TOR usage, but the scenario describes deliberate encrypted traffic patterns, which is not indicative of a simple misconfiguration.