200-201 Question 265
Single answerA security analyst is investigating suspicious traffic flagged by the intrusion detection system (IDS). Upon analysis, the analyst identifies multiple packets with a source address of 192.168.1.100, which matches an internal database server. However, the database server logs show no activity originating from it during the time of the flagged traffic. What is the most likely cause of this behavior?
- A
A misconfiguration in the IDS rules causing false positives.
- B
The source address was spoofed by an attacker.
- C
The database server was compromised and is sending unauthorized traffic.
- D
A legitimate user accessed the database server during this time.
Show answer and explanation
Correct answer: B
Explanation
The most likely explanation for the flagged traffic is that the source address was spoofed by an attacker. Source address spoofing is a common tactic in cybersecurity threats, where an attacker manipulates the source IP address in packets to mislead or bypass systems. Since no activity was logged on the database server matching the flagged traffic, it strongly indicates the source address is not genuine.
- A. Incorrect.
While misconfiguration in IDS rules can cause false positives, this does not explain why there was no activity logged on the database server despite packets being flagged with its source address.
- B. Correct.
Spoofing the source address is a common technique used by attackers to disguise the origin of malicious traffic. The lack of matching activity in the database server logs strongly suggests spoofing.
- C. Incorrect.
If the database server was compromised, there would likely be logs of activity originating from it during the flagged time period, which is not the case here.
- D. Incorrect.
The scenario explicitly states that the database server logs show no activity originating from it, ruling out legitimate user access.