200-201 Question 264
Single answerYou are analyzing a PCAP file from a suspected intrusion. Within the packet data, you notice an outbound connection to an unknown IP address on port 4444 using TCP. The payload contains an encoded command. Which key element of the intrusion can be identified from this evidence?
- A
Command and Control (C2) communication
- B
Distributed Denial of Service (DDoS) attack
- C
Brute-force login attempt
- D
Data exfiltration attempt
Show answer and explanation
Correct answer: A
Explanation
The PCAP file indicates an outbound TCP connection to an unknown IP on an unusual port (port 4444) with an encoded payload. This is a strong indicator of Command and Control (C2) communication, a technique used by attackers to remotely control compromised systems. Other options, such as DDoS, brute-force login, or data exfiltration, do not align with the observed behavior in the PCAP.
- A. Correct.
Command and Control (C2) communication is often characterized by outbound connections to unknown IP addresses, unusual ports, and encoded payloads used to maintain communication between an attacker and a compromised system.
- B. Incorrect.
A Distributed Denial of Service (DDoS) attack typically involves a large volume of traffic targeting a single system, rather than an outbound connection to a specific IP address.
- C. Incorrect.
A brute-force login attempt would involve repeated login requests, typically visible in the form of multiple authentication attempts, not an outbound TCP connection with encoded payloads.
- D. Incorrect.
Data exfiltration attempts generally involve transferring large amounts of data or sensitive information to an external server, which differs from the observed behavior of outbound traffic with encoded commands.