200-201 Question 199
Select 3A security analyst is monitoring network traffic and notices a surge in outbound data from an internal database server to an unfamiliar external IP address. The server also shows failed login attempts from multiple unknown IPs followed by a successful login. What set of indicators of attack (IoAs) should the analyst prioritize to determine if this is a potential cyberattack?
- A
Unusual outbound traffic to an external IP address
- B
Repeated failed login attempts followed by a successful login
- C
A temporary spike in CPU usage on the database server
- D
The presence of unauthorized tools or scripts on the server
- E
A legitimate software update performed on the server
Show answer and explanation
Correct answers: A, B, D
Explanation
Indicators of attack are used to identify malicious activities that could lead to or signify an ongoing cyberattack. In this scenario, the unusual outbound traffic, failed login attempts followed by success, and the presence of unauthorized tools point to malicious intent and should be prioritized for investigation. Temporary resource spikes or legitimate updates alone are not sufficient to indicate an attack without further evidence.
- A. Correct.
Unusual outbound traffic to an external IP address is a strong indicator of potential data exfiltration, which is a common tactic in cyberattacks.
- B. Correct.
Repeated failed login attempts followed by a successful login suggest possible brute force attempts or compromised credentials, which are clear signs of an attack.
- C. Incorrect.
A temporary spike in CPU usage might occur for reasons unrelated to an attack, such as routine system processes or legitimate resource usage.
- D. Correct.
The presence of unauthorized tools or scripts on the server indicates that the attacker may have already established persistence or is preparing for further exploitation.
- E. Incorrect.
A legitimate software update is a routine activity and is not an indicator of attack unless it is specifically confirmed to be tampered with or malicious.