nerdexam
Cisco

210-255 · Question #56

Refer to the exhibit. You notice that the email volume history has been abnormally high. Which potential result is true?

The correct answer is C. Several hosts in your network may be compromised.. Abnormally high outbound email volume from a network is a primary indicator that internal hosts have been compromised and are being used in a botnet or spam campaign.

Security Monitoring

Question

Refer to the exhibit. You notice that the email volume history has been abnormally high. Which potential result is true?

Exhibit

210-255 question #56 exhibit

Options

  • AEmail sent from your domain might be filtered by the recipient.
  • BMessages sent to your domain may be queued up until traffic dies down.
  • CSeveral hosts in your network may be compromised.
  • DPackets may be dropped due to network congestion.

How the community answered

(46 responses)
  • A
    13% (6)
  • B
    4% (2)
  • C
    78% (36)
  • D
    4% (2)

Why each option

Abnormally high outbound email volume from a network is a primary indicator that internal hosts have been compromised and are being used in a botnet or spam campaign.

AEmail sent from your domain might be filtered by the recipient.

Recipient filtering is a possible downstream consequence of a compromised domain being blacklisted, but it is an effect - not the direct explanation - for observing high outbound email volume in your history.

BMessages sent to your domain may be queued up until traffic dies down.

Message queuing applies to inbound delivery delays caused by recipient server load, not to abnormally high outbound email volume being generated from within your own network.

CSeveral hosts in your network may be compromised.Correct

Unusually high outbound email volume is a well-known indicator of compromise (IoC) where malware-infected hosts silently send large volumes of spam, phishing, or command-and-control messages. This behavior is characteristic of botnets, where multiple compromised machines act as spam relays controlled by a remote attacker.

DPackets may be dropped due to network congestion.

Packet drops due to network congestion are a network-layer event unrelated to application-layer email volume statistics surfaced in email history logs.

Concept tested: Botnet compromise indicators via email volume anomalies

Source: https://www.cisco.com/c/en/us/products/security/what-is-a-botnet.html

Topics

#email anomaly detection#botnet indicators#host compromise#security monitoring

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 210-255 Practice