Welcome to ExamTopics
ExamTopics Logo
- Expert Verified, Online, Free.
Mail Us [email protected]
Menu

Unlimited Access

Get Unlimited Contributor Access to the all ExamTopics Exams!
Take advantage of PDF Files for 1000+ Exams along with community discussions and pass IT Certification Exams Easily.
Comptia Discussions

Exam CS0-001 topic 1 question 408 discussion

Actual exam question from CompTIA's CS0-001
Question #: 408
Topic #: 1
[All CS0-001 Questions]

Ransomware is identified on a company's network that affects both Windows and MAC hosts. The command and control channel for encryption for this variant uses TCP ports from 11000 to 65000. The channel goes to good1. Iholdbadkeys.com, which resolves to IP address 72.172.16.2.
Which of the following is the MOST effective way to prevent any newly infected systems from actually encrypting the data on connected network drives while causing the least disruption to normal Internet traffic?

  • A. Block all outbound traffic to web host good1 iholdbadkeys.com at the border gateway.
  • B. Block all outbound TCP connections to IP host address 172.172.16.2 at the border gateway.
  • C. Block all outbound traffic on TCP ports 11000 to 65000 at the border gateway.
  • D. Block all outbound traffic on TCP ports 11000 to 65000 to IP host address 172.172.16.2 at the border gateway.
Show Suggested Answer Hide Answer
Suggested Answer: A 🗳️
by s3curity1 at June 2, 2020, 12:05 p.m.

Comments

Chosen Answer:
This is a voting comment (?) , you can switch to a simple comment.
Switch to a voting comment New
Submit Cancel
Hibster
Highly Voted 3 years, 10 months ago
Domain is best bet here
upvoted 5 times
...
s3curity1
Most Recent 3 years, 11 months ago
Are they thinking that the domain can resolve to other IP addresses in the future, that's why blocking via domain/url is the best choice?
upvoted 2 times
s3curity1
3 years, 11 months ago
I'd go with D on this one.
upvoted 3 times
...
Death2QuestionWriters
3 years, 6 months ago
Dynamic DNS
upvoted 1 times
...
CrashBandicoot
3 years, 11 months ago
Blocking the domain is the MOST effective way to deal with this one. Otherwise if you block all those ports you may have problem with other services/applications on the network or if you block the ip address then you may be blocking normal/expected business traffic to other domains under that same ip address.
upvoted 6 times
...
...

Get IT Certification

Unlock free, top-quality video courses on ExamTopics with a simple registration. Elevate your learning journey with our expertly curated content. Register now to access a diverse range of educational resources designed for your success. Start learning today with ExamTopics!

Start Learning for free
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel