200-201 Question 152
Single answerA cybersecurity analyst detects unusual outbound traffic from multiple endpoints within the network. Further investigation reveals communication with an external IP address over non-standard ports. What type of endpoint-based attack is most likely occurring in this scenario?
- A
Buffer overflow
- B
Command and control (C2)
- C
Phishing attack
- D
SQL injection
Show answer and explanation
Correct answer: B
Explanation
The scenario describes compromised endpoints communicating with an external IP over non-standard ports, which is a key indicator of command and control (C2) activity. C2 is often used by attackers to maintain communication with and control over infected devices within a network, enabling them to issue commands or exfiltrate data. The other options do not align with the described behavior in the scenario.
- A. Incorrect.
Buffer overflow attacks exploit vulnerabilities in software to overwrite memory, potentially causing unexpected behavior or system crashes. This type of attack does not typically result in unusual outbound traffic to external IPs.
- B. Correct.
Command and control (C2) attacks involve compromised endpoints communicating with an attacker-controlled server to receive instructions or exfiltrate data. The detection of outbound traffic to an external IP over non-standard ports is a common indicator of C2 activity.
- C. Incorrect.
Phishing attacks aim to trick users into revealing sensitive information, such as credentials, through deceptive emails or websites. While damaging, phishing does not involve external communications from endpoints as described in this scenario.
- D. Incorrect.
SQL injection is a web-based attack targeting databases through maliciously crafted SQL queries. This type of attack does not involve unusual outbound traffic from endpoints to external IPs.