350-201 Question 205
Single answerDuring a security investigation, a predictive AI system identifies unusual traffic patterns involving a specific IP address. The sequence of events suggests the early stages of a potential attack. Which of the following events most likely indicates the reconnaissance phase of this attack?
- A
A sudden spike in DNS queries targeting internal hostnames.
- B
High-volume traffic from a single IP address attempting to authenticate with multiple accounts.
- C
Exfiltration of large volumes of data to an external IP address.
- D
The use of encrypted communication channels with an untrusted external host.
Show answer and explanation
Correct answer: A
Explanation
Attack sequences often involve distinct phases such as reconnaissance, exploitation, and exfiltration. Predictive AI systems analyze traffic patterns to infer the phase of an attack. A spike in DNS queries targeting internal resources suggests that the attacker is in the reconnaissance phase, gathering information to proceed with further steps in the attack.
- A. Correct.
A sudden spike in DNS queries targeting internal hostnames is indicative of the reconnaissance phase as attackers might be attempting to gather details about internal network resources.
- B. Incorrect.
High-volume traffic attempting multiple authentications typically aligns with the brute force phase of an attack rather than reconnaissance.
- C. Incorrect.
Exfiltration of large volumes of data is a hallmark of the data exfiltration phase, which occurs later in the attack sequence.
- D. Incorrect.
The use of encrypted communication with an untrusted host is more indicative of command-and-control activity or data exfiltration phases, rather than reconnaissance.