Blocking C2 traffic effectively requires:

Question

Options

• AIgnoring encrypted traffic as it's secure by default
• BFocusing on inbound traffic only
• CAnalyzing network traffic for anomalies
• DAssuming all internal network traffic is safe

• A
  14% (5)
• B
  3% (1)
• C
  74% (26)
• D
  9% (3)

Explanation

Analyzing network traffic for anomalies (C) is correct because C2 communication - regardless of how it's disguised - produces detectable behavioral patterns: periodic beaconing, unusual DNS lookups, connections to rare external IPs, or odd data volumes. These signatures can be caught through traffic analysis even when the payload is encrypted.

Why the distractors fail:

• A is backwards - attackers deliberately use encryption (HTTPS, DNS-over-HTTPS) to hide C2 channels, so ignoring encrypted traffic is exactly what adversaries want you to do.
• B is incomplete - C2 callbacks are outbound traffic from the infected host to the attacker's server; focusing only on inbound means you miss the most critical flows.
• D is the "assumed breach" fallacy - lateral movement and insider threats mean internal traffic must be scrutinized too; zero-trust architecture exists precisely because of this assumption.

Memory tip: Think "C2 = Catch (traffic) Anomalies." Both start with C, and catching behavioral anomalies is the only option that covers all traffic directions and encryption states.

No community discussion yet for this question.