Exam CS0-003 topic 1 question 56 discussion

Be careful its easy to pick answer B - data exfiltration but this is incorrect, the scenario doesn't explicitly mention the nature of the outgoing traffic or whether sensitive data is involved. It simply states that there are regular outgoing HTTPS connections to a public IP address, both during and after work hours.

The 2 possibilities are A or B. The scenario indicates 'persistence' , 24 hour traffic with a public IP address. Also the traffic flow is outbound from the network. Persistence implies a C2 has been established. The outbound traffic suggests data being exfiltrated. Although both the presence of a C2 and outbound traffic exists, I would choose C2. The C2 had to exist before data could be exfiltrated.

A is correct. Beaconing is a means for a network node to advertise its presence and establish a link with other nodes.

I agree with ares1027. Yes, it's coming from a data center, but C&C has to exist prior to Data exfil. Also, HTTPS would not be the protocol for data exfil.

There are only two possibilities: A or B. The answer is not B as we are not given any indication of data being moved out of the organization's environment. If one wanted to exfiltrate data, it isn't plausible to do it via HTTP or HTTPS. When we consider the frequent ping-like behavior happing around the clock, it is beaconing.

Regular outgoing HTTPS connections, especially to a public IP address, from a server that should not be communicating outbound is indicative of data exfiltration activity. The fact that this occurs consistently during and after work hours strengthens this conclusion. A) C2 beaconing would likely be more intermittent than a continuous pattern. C) The traffic is over expected HTTPS ports rather than unexpected ports. D) Host scanning would be unlikely to result in persistent flows to one IP. E) A rogue device is less likely than malicious data theft activity. Based on the CompTIA CySA+ CS0-003 exam objectives, specifically domain 1.2 Analyze indicators of potentially malicious activity, the best answer is B - Data exfiltration.

The most likely explanation for this traffic pattern is C2 beaconing activity. C2 beaconing activity is a type of network traffic that indicates a compromised system is sending periodic messages or signals to an attacker’s system using various protocols, such as HTTP(S), DNS, ICMP, or UDP.

The most likely explanation for the regular outgoing HTTPS connections from a data-center server to a public IP address, both during after-hours and work hours, is: A. C2 beaconing activity Explanation: "C2" stands for "Command and Control." C2 beaconing is a behavior associated with malware or compromised systems, where the infected system regularly communicates with a remote command and control server. This communication is often used by attackers to maintain control over the compromised system, receive instructions, or exfiltrate data