200-201 Question 153
Single answerA security analyst observes unusual outbound traffic from multiple endpoints within the network. After investigation, the analyst discovers that an attacker exploited a buffer overflow vulnerability on these endpoints to execute arbitrary code. The attacker is now using these compromised endpoints to communicate with a remote server. What type of attack is being observed, and what is the likely purpose of the attack?
- A
Command and Control (C2) attack to remotely control compromised machines
- B
Phishing attack to steal user credentials
- C
Denial of Service attack to disrupt network operations
- D
Man-in-the-Middle (MitM) attack to intercept communication
Show answer and explanation
Correct answer: A
Explanation
The scenario describes an attacker exploiting a buffer overflow vulnerability to execute arbitrary code on endpoints. This allows the attacker to use the compromised machines as part of a Command and Control (C2) infrastructure, enabling remote communication and control. This is a common endpoint-based attack that leverages vulnerabilities in systems for malicious purposes.
- A. Correct.
Correct. Command and Control (C2) is a technique where attackers use compromised endpoints to communicate with and control them remotely, often after exploiting vulnerabilities like buffer overflows.
- B. Incorrect.
Incorrect. A phishing attack typically involves social engineering to trick users into revealing sensitive information, not exploiting buffer overflows or setting up remote control.
- C. Incorrect.
Incorrect. A Denial of Service (DoS) attack aims to disrupt services by overwhelming the target with traffic, not by exploiting vulnerabilities to gain control of endpoints.
- D. Incorrect.
Incorrect. A Man-in-the-Middle attack involves intercepting and manipulating communication between parties, not using endpoints to communicate with a remote server for control purposes.