312-49V11: Computer Hacking Forensic InvestigatorDemo

By ECCouncil · Question Mode

QuestionQ154

Logs and Network Forensics

You are an information security analyst at a large pharmaceutical company. During a routine audit-log review, you notice a significant volume of egress traffic to various IP addresses on destination port 22 during off-peak hours. You research some of the IP addresses and find that many are in Eastern Europe. What is the most likely cause of this traffic?

  • A The organization's primary internal DNS server has been compromised and is performing DNS zone transfers to malicious external entities
  • B Data is being exfiltrated by an advanced persistent threat (APT)
  • C Malicious software on internal system is downloading research data from partner SFTP servers in Eastern Europe
  • D Internal systems are downloading automatic Windows updates
Explanation

Large volumes of outbound SSH/SFTP traffic on port 22 to numerous unfamiliar external addresses during off-peak hours are consistent with an advanced persistent threat staging and exfiltrating data. DNS zone transfers use DNS rather than port 22, and Windows Update does not normally use SSH.

Community Discussion

No comments yet. Be the first to start the discussion!