200-201 Question 198
Select 3A cybersecurity analyst is monitoring network activity and notices an increase in outbound traffic to an unfamiliar external IP address originating from multiple internal hosts. Upon further investigation, they find that the outbound traffic consists of encoded data packets. Which of the following are indicators of attack (IoAs) in this scenario?
- A
Unusual outbound traffic patterns to an unfamiliar IP address
- B
Encoded data packets being sent outside the network
- C
Increased internal communication between servers within the network
- D
Multiple internal hosts communicating with the same external IP address
- E
A failed user login attempt from an internal workstation
Show answer and explanation
Correct answers: A, B, D
Explanation
Indicators of attack (IoAs) are observable patterns or behaviors that suggest an adversary is actively attempting to compromise an environment. In this scenario, unusual outbound traffic, encoded data packets, and multiple hosts targeting the same external IP address are strong indicators of malicious activity. These behaviors suggest potential data exfiltration or communication with a command-and-control server.
- A. Correct.
Unusual outbound traffic patterns to unfamiliar IP addresses are a common indicator of attack, as they may signify data exfiltration or command-and-control communication.
- B. Correct.
Encoded data packets being sent outside the network often indicate an attempt to conceal malicious activity, such as exfiltrating sensitive information.
- C. Incorrect.
Increased internal communication between servers within the network might be normal in specific scenarios and is not a clear indicator of an attack without additional context.
- D. Correct.
Multiple internal hosts communicating with the same external IP address can indicate coordinated malicious activity, such as a botnet or centralized data exfiltration.
- E. Incorrect.
A single failed user login attempt from an internal workstation is a weak indicator of an attack and may simply result from user error or misconfiguration.