312-50 Question 229
Single answer▪ BotnetsDuring an internal security assessment, you are asked to determine whether several employee workstations are part of a botnet without disrupting normal business operations. The SOC has already observed that a few hosts make periodic outbound connections to changing public IP addresses over uncommon high ports, but endpoint antivirus has not raised alerts. Which action would provide the strongest evidence that the hosts are participating in a botnet command-and-control (C2) channel while minimizing operational impact?
- A
Mirror the suspicious hosts' traffic and analyze it for recurring beaconing patterns, encrypted outbound sessions, and shared indicators such as domains, JA3/TLS fingerprints, or packet timing consistency
- B
Immediately run an aggressive vulnerability scan against the suspicious hosts to trigger the malware and confirm the botnet infection
- C
Block all outbound traffic from the suspicious hosts at the perimeter firewall and wait to see whether users report application failures
- D
Delete the hosts' temporary files and browser caches, then check whether the unusual outbound traffic stops
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use passive traffic analysis to identify command-and-control behavior consistent with botnet participation. In real environments, botnets often rely on periodic beaconing, domain generation techniques, fast-flux infrastructure, TLS-encrypted sessions, and repeatable communication intervals. Observing these characteristics across multiple endpoints is a practical way to build high-confidence evidence before containment or eradication. This aligns with common incident-response and network-monitoring best practices: collect evidence first, minimize changes to potentially compromised systems, and use network telemetry such as NetFlow, full packet capture, DNS logs, proxy logs, and IDS/IPS alerts. Guidance from NIST incident handling practices and CISA incident response recommendations supports careful evidence collection, scoping, and analysis before taking disruptive actions unless immediate containment is required.
- A. Correct.
Correct. Passive network monitoring is the least disruptive and most defensible first step for validating suspected botnet activity. Bot-infected hosts commonly exhibit beaconing behavior to C2 infrastructure, including periodic callbacks, communication with fast-changing IPs or domains, and repeatable network characteristics. Traffic mirroring and analysis can reveal patterns across multiple hosts without altering system state, which is important in both assessment and incident-response contexts.
- B. Incorrect.
Incorrect. An aggressive vulnerability scan is not an appropriate validation method for suspected botnet participation. It can disrupt business services, generate noise, and potentially alter malware behavior, but it does not reliably prove C2 activity. This reflects the misconception that active scanning is the best first step for every investigation; in botnet detection, passive observation is usually preferred initially.
- C. Incorrect.
Incorrect. Blocking all outbound traffic may contain the issue, but it does not by itself provide the strongest evidence that the systems are part of a botnet. It is also more disruptive to users and business operations. Containment is important later, but the scenario asks for evidence gathering with minimal operational impact.
- D. Incorrect.
Incorrect. Deleting temporary files and browser caches is not a reliable method for identifying or validating botnet infection. Bot malware often persists through services, scheduled tasks, registry run keys, drivers, or other mechanisms unrelated to browser cache. This option reflects a common but incorrect assumption that suspicious outbound traffic is primarily caused by browser artifacts.