200-201 Question 210
Single answerA security analyst is investigating an unusual spike in outbound network traffic from a server in the network. Upon reviewing the SIEM logs, the analyst notices multiple login attempts from an unfamiliar IP address followed by a large volume of data transfers. What is the most likely explanation for this activity based on the logs?
- A
A brute force attack followed by data exfiltration
- B
A Distributed Denial-of-Service (DDoS) attack
- C
Routine data backups initiated by the organization
- D
A system update causing temporary increase in network traffic
Show answer and explanation
Correct answer: A
Explanation
The logs indicate a sequence of suspicious activities: repeated login attempts from an unfamiliar IP (potential brute force attack) followed by large data transfers (potential data exfiltration). This aligns with the pattern of an attacker gaining unauthorized access and then extracting sensitive data.
- A. Correct.
The combination of multiple login attempts (indicative of a brute force attack) and a large volume of data transfers (indicative of data exfiltration) suggests malicious activity.
- B. Incorrect.
DDoS attacks typically involve overwhelming a system with traffic, not targeted login attempts or data transfers.
- C. Incorrect.
Routine data backups would not involve unusual login attempts from an unfamiliar IP address.
- D. Incorrect.
System updates might increase traffic temporarily but would not involve login attempts from an unfamiliar IP address.