200-201 Question 370
Single answerA cybersecurity analyst is monitoring a web application and notices several sessions with unusually long durations, far exceeding the average session duration for legitimate users. What is the most likely reason for these prolonged session durations?
- A
The sessions are associated with automated scripts or bots performing reconnaissance.
- B
The users are experiencing slow internet connections, causing their sessions to remain open longer.
- C
The sessions are legitimate but involve users conducting highly complex tasks, requiring more time.
- D
The sessions are potentially linked to an attacker maintaining access to the application by exploiting vulnerabilities.
Show answer and explanation
Correct answer: D
Explanation
Prolonged session durations, especially if they deviate from typical user patterns, are a common indicator of malicious activity. Attackers may exploit vulnerabilities to maintain persistent access to a system or application. Monitoring session duration is essential for detecting potential security incidents.
- A. Incorrect.
While automated scripts or bots could cause abnormal traffic patterns, they typically create short-lived, high-frequency sessions rather than prolonged ones.
- B. Incorrect.
Slow internet connections might increase session duration slightly, but they are unlikely to result in significantly prolonged sessions over multiple instances.
- C. Incorrect.
Although some legitimate users may engage in lengthy tasks, this is uncommon and does not typically account for numerous prolonged sessions, especially if they deviate from normal user behavior.
- D. Correct.
Attackers may intentionally keep sessions open for extended periods to maintain access, exfiltrate data, or perform lateral movement, which aligns with the observed behavior.