200-201 Question 134
Single answerYou are a cybersecurity analyst reviewing a suspicious event in a network monitoring tool. You notice a spike in traffic from a single IP address, and upon inspecting session data, you observe multiple short-lived TCP connections to various ports on a target server. Which type of attack is most likely occurring based on this session data?
- A
Port scanning
- B
Distributed Denial of Service (DDoS)
- C
DNS spoofing
- D
Man-in-the-middle attack
Show answer and explanation
Correct answer: A
Explanation
Port scanning is a reconnaissance technique used by attackers to identify open ports and services running on a target system. The session data in the scenario, showing multiple short-lived TCP connections to various ports from the same IP, is a clear indicator of port scanning activity. Understanding session data is crucial for identifying and responding to such potential threats.
- A. Correct.
Port scanning is characterized by multiple short-lived connections to various ports on a target system, which matches the scenario described in the session data.
- B. Incorrect.
DDoS attacks typically involve a large amount of sustained traffic from multiple sources to overwhelm a target, which is not consistent with the pattern observed in this case.
- C. Incorrect.
DNS spoofing involves falsifying DNS responses to redirect traffic, and it would not generate the session data pattern described in the scenario.
- D. Incorrect.
A man-in-the-middle attack typically involves intercepting and modifying communications, and the session data described does not indicate such activity.