200-201 Question 235
Single answerYou are a Security Analyst investigating a suspected data exfiltration incident. While analyzing proxy logs, you notice repeated connections to an external IP address at irregular intervals over HTTP. The request endpoints include '/download' and '/upload'. Additionally, the user-agent string in these requests mimics legitimate browser traffic. What is the most likely purpose of these connections?
- A
Normal user browsing activity
- B
Malware beaconing and data exfiltration
- C
A misconfigured application performing regular updates
- D
Internal DNS misconfiguration causing unnecessary external requests
Show answer and explanation
Correct answer: B
Explanation
Proxy logs are crucial for identifying suspicious activity. In this scenario, repeated irregular HTTP connections to an external IP with endpoints like '/upload' and '/download' indicate potential malware beaconing and data exfiltration. The use of a legitimate-looking user-agent string is a common tactic to evade detection. Understanding such patterns is essential for a Security Analyst to detect and mitigate threats effectively.
- A. Incorrect.
This is unlikely as normal browsing activity rarely involves repeated connections to the same external IP with endpoints like '/upload' and '/download'.
- B. Correct.
Malware beaconing and data exfiltration often involve irregular, repeated connections to external IPs, mimicking legitimate traffic through user-agent strings, and using endpoints such as '/upload' or '/download' to transfer data.
- C. Incorrect.
While misconfigured applications might cause repeated requests, they typically do not involve endpoints such as '/upload' or '/download', which are indicative of data transfers.
- D. Incorrect.
DNS misconfiguration would result in failed or repeated DNS queries, not HTTP requests with specific endpoints like '/upload' or '/download'.