nerdexam
Cisco

200-201 · Question #230

Refer to the exhibit. A network administrator is investigating suspicious network activity by analyzing captured traffic. An engineer notices abnormal behavior and discovers that the default user…

The correct answer is C. indicators of data exfiltration HTTP requests must be plain text. The presence of a default user agent in HTTP headers for data being transmitted, especially when combined with abnormal behavior, is a strong indicator of data exfiltration.

Submitted by khalil_dz· Mar 6, 2026Network Intrusion Analysis

Question

Refer to the exhibit. A network administrator is investigating suspicious network activity by analyzing captured traffic. An engineer notices abnormal behavior and discovers that the default user agent is present in the headers of requests and data being transmitted. What is occurring?

Exhibit

200-201 question #230 exhibit

Options

  • Aindicators of denial-of-service attack due to the frequency of requests
  • Bgarbage flood attack attacker is sending garbage binary data to open ports
  • Cindicators of data exfiltration HTTP requests must be plain text
  • Dcache bypassing attack: attacker is sending requests for noncacheable content

How the community answered

(20 responses)
  • A
    5% (1)
  • B
    15% (3)
  • C
    75% (15)
  • D
    5% (1)

Why each option

The presence of a default user agent in HTTP headers for data being transmitted, especially when combined with abnormal behavior, is a strong indicator of data exfiltration.

Aindicators of denial-of-service attack due to the frequency of requests

While denial-of-service attacks involve frequent requests, the specific indicator mentioned is the default user agent in the headers for data transmission, not just the frequency.

Bgarbage flood attack attacker is sending garbage binary data to open ports

A garbage flood attack involves sending malformed or random data to open ports, which is not directly indicated by a default user agent in HTTP headers.

Cindicators of data exfiltration HTTP requests must be plain textCorrect

Data exfiltration involves the unauthorized transfer of data, and attackers often use default user agents in HTTP requests to send sensitive information out of a network. This method attempts to blend malicious traffic with legitimate web traffic, making it a common covert channel for moving data.

Dcache bypassing attack: attacker is sending requests for noncacheable content

Cache bypassing attacks focus on preventing content delivery networks from caching content, which is unrelated to the specific anomaly of a default user agent in data transmission headers.

Concept tested: Data exfiltration indicators

Source: https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4688

Topics

#HTTP headers#user agent#data exfiltration#network analysis

Community Discussion

No community discussion yet for this question.

Full 200-201 Practice