200-201 Question 138
Single answerYou are a cybersecurity analyst investigating potential anomalies in an organization's network traffic. By analyzing statistical data from the network flow logs, you notice a sudden spike in outbound traffic volume from a single host within a short period. What could this statistical anomaly most likely indicate?
- A
The host is running a scheduled backup to a remote server.
- B
The host is compromised and participating in a data exfiltration attack.
- C
A legitimate software update is being downloaded to the host.
- D
The host is experiencing a hardware failure causing packet duplication.
Show answer and explanation
Correct answer: B
Explanation
Statistical data analysis of network traffic can reveal patterns and anomalies indicative of security issues. A sudden increase in outbound traffic from one host is a common indicator of potential data exfiltration. While other options could theoretically explain an increase in traffic, only data exfiltration aligns with the scenario's sudden and anomalous nature.
- A. Incorrect.
While backups can generate significant outbound traffic, they are typically scheduled and predictable, not sudden spikes. This scenario is less likely unless the timing matches a known backup schedule.
- B. Correct.
A sudden spike in outbound traffic volume can often indicate data exfiltration, where a compromised host is sending sensitive data to an external attacker. This is a common anomaly detected in cybersecurity investigations.
- C. Incorrect.
Software updates may involve downloading data rather than generating unusual outbound traffic spikes. Additionally, updates tend to follow predictable patterns and are often logged.
- D. Incorrect.
Hardware failures typically result in packet loss or errors, not a sudden increase in outbound traffic. Packet duplication due to hardware failure is rare and would not cause a significant traffic spike.