200-201 Question 302
Single answerA cybersecurity analyst is investigating suspicious traffic in a network. They observe that a particular source IP address is repeatedly attempting to access multiple destination IP addresses within the same subnet over a short period of time. What could this behavior most likely indicate?
- A
A legitimate application scanning the network for available services
- B
A Distributed Denial-of-Service (DDoS) attack
- C
A reconnaissance scan indicating a potential attacker gathering information
- D
A misconfigured device causing unintended traffic
Show answer and explanation
Correct answer: C
Explanation
The described behavior aligns with reconnaissance activity. Attackers often use scanning tools to probe multiple IP addresses within a subnet to identify active hosts, open ports, or other network details. Understanding the patterns of source and destination IP addresses is critical for detecting and mitigating such threats.
- A. Incorrect.
While legitimate applications may scan a network, they typically operate in a controlled and predictable manner, not repeatedly targeting multiple destinations in a short timeframe.
- B. Incorrect.
A DDoS attack usually involves multiple source IP addresses targeting a single destination, which is the opposite of the scenario described.
- C. Correct.
This behavior is characteristic of a reconnaissance scan, where an attacker probes multiple devices in a network to gather information about potential vulnerabilities.
- D. Incorrect.
A misconfigured device might cause unintended traffic, but it would not likely exhibit the systematic targeting of multiple destinations typical of a reconnaissance scan.