Which two methods might be used by an analyst to detect SSL/TLS encrypted command-and- control communication? (Choose two.)

Question

Options

• Aperform decryption and inspection of SSL/TLS traffic
• Bperform firewall HTTP application inspection to detect for the command and control traffic
• Cperform IPS HTTP deep packets inspection to detect for the command and control traffic
• Dperform analysis of the NetFlow data to detect anomalous TLS/SSL flows

• A
  54% (28)
• B
  13% (7)
• C
  33% (17)

Explanation

Because SSL/TLS encrypts the payload, content-based inspection (HTTP application inspection or deep packet inspection of HTTP) cannot read the actual traffic - those methods (B and C) apply to cleartext protocols. The two valid approaches are: (A) SSL/TLS decryption and inspection, where the analyst terminates and re-encrypts the session (e.g., using a proxy or MITM device) to inspect the plaintext; and (D) NetFlow analysis, which examines connection metadata - IP addresses, ports, flow volume, duration, and timing patterns - without needing to decrypt the content. Anomalous patterns in NetFlow data (e.g., beaconing intervals, unusual destination IPs, abnormal data volumes) can reveal C2 activity even when the traffic is encrypted.

No community discussion yet for this question.