A mitigation strategy for blocking C2 traffic that involves analyzing behavioral patterns is known as:

Question

Options

• AWhitelisting all inbound connections
• BDeploying anomaly-based detection
• CDisabling network monitoring tools
• DIncreasing network bandwidth

• A
  4% (1)
• B
  92% (23)
• D
  4% (1)

Explanation

Anomaly-based detection (B) works by establishing a baseline of normal network behavior and flagging deviations - making it ideal for catching C2 traffic, which often exhibits unusual patterns like beaconing at regular intervals, connections to rare external IPs, or atypical data volumes, even when the traffic looks superficially legitimate.

Why the distractors are wrong:

• A (Whitelisting inbound connections) reduces attack surface but does nothing to analyze behavior - C2 often uses allowed ports (80/443) and would pass right through.
• C (Disabling network monitoring) is the opposite of a mitigation; it eliminates your visibility entirely.
• D (Increasing bandwidth) is a capacity measure with no security value against C2 communication.

Memory tip: Think "anomaly = abnormal behavior" - C2 traffic behaves abnormally (regular beacons, odd destinations), so anomaly-based detection is specifically designed to catch it. The key phrase in any exam question is "behavioral patterns" → that's always anomaly/heuristic detection, never signature-based or access-control answers.

No community discussion yet for this question.