350-201 Question 207
Single answerYou are a security analyst monitoring network traffic using a Cisco security solution that integrates predictive AI analysis. The system alerts you to a potential attack based on anomalous traffic patterns. The sequence of events includes increased DNS queries to nonexistent domains, followed by a surge in outbound connections to unfamiliar IP addresses. Based on the predictive AI's analysis, what is the most likely type of attack being detected?
- A
A Distributed Denial-of-Service (DDoS) attack
- B
A phishing attack
- C
A data exfiltration attempt
- D
A Domain Generation Algorithm (DGA)-based malware communication
Show answer and explanation
Correct answer: D
Explanation
The sequence of increased DNS queries to nonexistent domains followed by outbound connections to unfamiliar IPs is a strong indicator of DGA-based malware activity. Predictive AI analysis is capable of identifying such patterns early, enabling security teams to respond to potential command-and-control communication attempts before they escalate into a full-blown attack.
- A. Incorrect.
A Distributed Denial-of-Service (DDoS) attack typically involves flooding a target with excessive traffic to overwhelm resources, but it does not usually involve a pattern of increased DNS queries or outbound connections to unfamiliar IPs.
- B. Incorrect.
A phishing attack primarily involves deceptive communication to trick users into revealing sensitive information and does not align with the described traffic pattern.
- C. Incorrect.
A data exfiltration attempt involves transferring sensitive data out of the network, but the described sequence of events suggests communication to C2 servers rather than direct data exfiltration.
- D. Correct.
A Domain Generation Algorithm (DGA)-based malware communication often generates numerous DNS queries to random domains, looking for a valid command-and-control (C2) server. This behavior aligns closely with the described sequence of events.