200-201 Question 260
Single answerA cybersecurity analyst is tasked with investigating unusual network activity on their organization's network. They use NetFlow data to analyze the traffic and observe a single external IP address communicating with multiple internal hosts over a short period of time. The analyst suspects this could be indicative of malicious behavior. Which of the following potential threats is MOST likely based on the observed NetFlow data?
- A
Distributed Denial of Service (DDoS) attack
- B
Port scanning from an external attacker
- C
Command-and-Control (C2) communication
- D
Data exfiltration
Show answer and explanation
Correct answer: B
Explanation
NetFlow data provides transactional information about network traffic, such as source and destination IPs, ports, and the volume of data transferred. In this scenario, the single external IP address communicating with multiple internal hosts suggests reconnaissance activity, specifically port scanning, where an attacker attempts to identify vulnerabilities in the network by probing multiple internal systems.
- A. Incorrect.
A DDoS attack typically involves multiple external sources overwhelming a single internal host, not a single external IP communicating with multiple internal hosts.
- B. Correct.
Port scanning is a common reconnaissance activity where an external attacker probes multiple internal hosts to identify open ports and services. The observed NetFlow pattern aligns with this behavior.
- C. Incorrect.
Command-and-Control (C2) communication is usually characterized by repeated or periodic communication between an internal host and a malicious external server, not widespread communication with multiple hosts.
- D. Incorrect.
Data exfiltration often involves significant data transfer from a single internal host to an external destination, which is not described in this scenario.