Questão 11 — CompTIA SY0-701 CompTIA Security+ Certification Exam
A security analyst is investigating suspicious network traffic on a monitored host. The analyst observes multiple failed authentication attempts from external IP addresses targeting the SSH service over a 5- minute period, followed by a sudden surge in outbound HTTPS connections to unknown destinations. Which of the following indicators of compromise is MOST relevant to this scenario?
- A. Unusual network traffic patterns and anomalous outbound connections.
- B. Legitimate user login activity from trusted internal networks.
- C. Scheduled backup processes communicating with external storage repositories.
- D. Periodic DNS lookups for authorized third-party services.
Resposta correta:
A
Explicação
Explanation: Correct answer: A. Unusual network traffic patterns and anomalous outbound connections. This scenario describes classic indicators of compromise (IOC): failed authentication attempts suggesting brute-force attack attempts, followed by anomalous outbound connections that could indicate data exfiltration or command- and-control communication. These are textbook IOCs that warrant immediate investigation. Options B, C, and D describe normal, expected network activities that would not constitute indicators of compromise. Security analysts must distinguish between baseline legitimate traffic and truly suspicious patterns to effectively triage alerts and focus investigation efforts.
Quer todas as 907 questões por R$ 1,00?