CS0-003 Question 34

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose A2

  Beaconing is periodic communication between a compromised system and an external command-and-control (C2) server. Your system sends small, regular outbound signals. Attackers use it to check in, receive commands, or exfiltrate data. The traffic follows fixed intervals or predictable patterns.

• Chose A2

  The analyst observed an internal device sending HTTPS traffic with unusual characters in the header to a known-malicious IP in another country. This behavior is indicative of beaconing, which occurs when malware or a compromised system periodically contacts a command and control (C2) server for instructions. The extra characters in the header suggest data exfiltration, encoding, or evasion techniques used by malware to avoid detection.

• 1

  Beaconing Explained: Beaconing is a technique used by malware or compromised systems to communicate with a command and control (C&C) server. Here's how it works: Compromised Device: A device on the internal network becomes infected with malware or compromised by an attacker. Communication Channel: The malware establishes a connection, typically HTTPS for encryption, to a known malicious IP address (the C&C server) located anywhere in the world. Hidden Communication: The communication might use seemingly normal protocols (HTTPS) but often includes additional characters in the header that act as a signal to the C&C server. These extra characters might be difficult to detect without proper inspection. C&C Server Purpose: The C&C server can then send instructions to the compromised device, download additional malware, or exfiltrate stolen data.