350-201 Question 206
Single answerDuring a network security analysis using predictive AI, you notice an unusual spike in outbound traffic from a server in your data center, followed by a series of failed login attempts to other servers. What sequence of events should you interpret based on the AI's traffic pattern analysis?
- A
A data exfiltration attempt followed by lateral movement attempts
- B
A distributed denial-of-service (DDoS) attack targeting your server
- C
A legitimate spike in traffic caused by a scheduled backup process
- D
A phishing attempt targeting internal users
Show answer and explanation
Correct answer: A
Explanation
Predictive AI analysis helps identify patterns that indicate malicious activity. In this case, the sequence of events, an outbound traffic spike followed by failed login attempts, matches the behavior of an attacker attempting data exfiltration and lateral movement. This sequence is critical to recognize for effective incident response.
- A. Correct.
This is the correct interpretation as the spike in outbound traffic suggests potential data exfiltration and the failed login attempts indicate lateral movement attempts within the network.
- B. Incorrect.
A DDoS attack typically involves inbound traffic overwhelming a server, not an outbound spike combined with failed login attempts.
- C. Incorrect.
A scheduled backup process would generate predictable traffic patterns and would not typically coincide with failed login attempts.
- D. Incorrect.
Phishing attempts would be directed at users via emails or messages and are unlikely to involve the observed outbound traffic spike and login failures.