200-201 Question 88
Single answerA cybersecurity analyst is monitoring network traffic and notices a sudden increase in outbound data transfers from an internal server that typically handles small, infrequent data uploads. The server's outbound traffic is directed to an unfamiliar external IP address. What is the most likely explanation for this behavior?
- A
The server is experiencing a normal increase in business-related activity.
- B
An employee is manually backing up sensitive data to a personal cloud storage account.
- C
The server has been compromised and is exfiltrating sensitive data to an external attacker.
- D
The server is sending legitimate updates for a newly installed software application.
Show answer and explanation
Correct answer: C
Explanation
The described scenario exhibits indicators of potential data loss, such as a server generating unusual outbound traffic to an unfamiliar IP address. This behavior is a common symptom of data exfiltration, wherein a compromised system is used to send sensitive data to an external attacker. Cybersecurity analysts must be vigilant in identifying such anomalies in traffic profiles to mitigate potential data breaches.
- A. Incorrect.
This explanation is unlikely because the increase in outbound traffic is unusual for the server's normal behavior, and the traffic is directed to an unfamiliar IP address, which raises suspicion.
- B. Incorrect.
While this is a possibility, it would typically involve more direct human interaction and is less likely to account for a large, sudden, and unusual increase in outbound traffic.
- C. Correct.
This is the most likely explanation given the scenario. Sudden, unusual outbound traffic to an unfamiliar IP address is a common indicator of data exfiltration by a threat actor after compromising the server.
- D. Incorrect.
Although legitimate software updates can generate outbound traffic, they generally do not cause significant increases in data transfer volumes, and updates are usually sent to known, trusted domains rather than unfamiliar IP addresses.