Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
CompTIA CySA+ Cybersecurity Analyst · CompTIA
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
Correct Answer: D. Beaconing Analysis: Beaconing refers to the activity where malware or compromised systems regularly check in with a command and control (C2) server for instructions or to report status. This is characterized by consistent and repeated network traffic from an internal host to an external server, especially one that is blocklisted. Explanation of Other Options: A. Data exfiltration: This involves transferring sensitive data out of the organization, but it would typically show large amounts of data being sent, not just consistent requests. B. Rogue device: This refers to unauthorized devices connected to the network, which may not necessarily show consistent traffic to a specific external server. C. Scanning: Scanning involves probing other devices or networks for vulnerabilities and would show different traffic patterns, usually a variety of destination IP addresses rather than consistent connections to a single blocklisted server.
The answer is D. Beaconing.
C. Scanning In this scenario, the consistent requests originating from an internal host to a blocklisted external server indicate scanning activity. Scanning typically involves sending multiple requests or probes to various hosts or services to identify vulnerabilities or discover open ports. When an internal host is repeatedly attempting to connect to a blocklisted external server, it suggests that it may be attempting to scan or probe the server for vulnerabilities or open ports. This behavior should be investigated further to determine the intent and potential risks associated with the scanning activity.