200-201 Question 301
Single answerA cybersecurity analyst is investigating network traffic related to a potential data exfiltration attempt. In reviewing the logs, the analyst notices repeated communication between an internal IP address (192.168.10.25) and an external IP address (203.0.113.45) on port 22. What is the most likely role of the external IP address in this scenario?
- A
The external IP address is acting as a legitimate internal server.
- B
The external IP address is a potential attacker or malicious server.
- C
The external IP address is a backup server for the organization.
- D
The external IP address is a misconfigured internal device.
Show answer and explanation
Correct answer: B
Explanation
The external IP address (203.0.113.45) is outside the internal network range and is communicating with an internal host over port 22. Port 22 is typically used for SSH traffic, and repeated communication in this context could indicate unauthorized access or data exfiltration by a malicious actor. Identifying the external IP address as a potential attacker or malicious server is the most logical conclusion based on the evidence presented.
- A. Incorrect.
This is incorrect because the external IP address is not part of the internal network range (192.168.x.x), meaning it cannot be a legitimate internal server.
- B. Correct.
This is correct because the external IP address is communicating over port 22 (commonly used for SSH), which could indicate unauthorized data exfiltration or malicious activity.
- C. Incorrect.
This is incorrect because backup servers, if external, are typically pre-approved and monitored. The context of suspicious communication does not align with this explanation.
- D. Incorrect.
This is incorrect because misconfigured internal devices would not have an external IP address unless explicitly configured as such, which is not evident here.