nerdexam
Cisco

200-201 · Question #51

An analyst is investigating a host in the network that appears to be communicating to a command and control server on the Internet. After collecting this packet capture the analyst cannot determine…

The correct answer is B. transport layer security encryption. If an analyst cannot determine the technique and payload from a packet capture of C2 communication, it strongly suggests the traffic is encrypted, making its contents unreadable.

Submitted by skyler.x· Mar 6, 2026Network Intrusion Analysis

Question

An analyst is investigating a host in the network that appears to be communicating to a command and control server on the Internet. After collecting this packet capture the analyst cannot determine the technique and payload used for the communication. Which obfuscation technique is the attacker using?

Exhibit

200-201 question #51 exhibit

Options

  • ABase64 encoding
  • Btransport layer security encryption
  • CSHA-256 hashing
  • DROT13 encryption

How the community answered

(31 responses)
  • A
    6% (2)
  • B
    71% (22)
  • C
    3% (1)
  • D
    19% (6)

Why each option

If an analyst cannot determine the technique and payload from a packet capture of C2 communication, it strongly suggests the traffic is encrypted, making its contents unreadable.

ABase64 encoding

Base64 encoding is a simple encoding scheme that makes binary data text-safe, but it is not encryption and can be easily decoded to reveal the original payload.

Btransport layer security encryptionCorrect

Transport Layer Security (TLS) encryption, often referred to as SSL/TLS, encrypts the entire communication payload between the client and server, preventing an analyst from directly observing the technique or payload within a packet capture without decryption.

CSHA-256 hashing

SHA-256 hashing is a one-way cryptographic function used for data integrity verification, not for obscuring communication content that needs to be transmitted and then revealed.

DROT13 encryption

ROT13 encryption is a trivial substitution cipher that offers very weak security and would be easily deciphered, not preventing an analyst from determining the payload.

Concept tested: Network traffic obfuscation via encryption

Source: https://learn.microsoft.com/en-us/windows-server/security/tls/tls-ssl-protocol-overview

Topics

#TLS encryption#C2 communication#packet analysis#obfuscation

Community Discussion

No community discussion yet for this question.

Full 200-201 Practice