To determine C2 communications from infected hosts, analysts should examine:

Question

Options

• AApplication version updates
• BEncrypted traffic patterns
• CCPU temperature logs
• DEmail content filters

• A
  5% (1)
• B
  75% (15)
• C
  5% (1)
• D
  15% (3)

Explanation

Encrypted traffic patterns (B) reveal C2 communications because malware typically maintains persistent, beaconing connections to attacker-controlled servers using encrypted channels (TLS/HTTPS) to evade content inspection - analysts look for anomalies like unusual beacon intervals, odd destination IPs, or encrypted traffic on non-standard ports.

Why the distractors are wrong:

• A (Application version updates): Version checks are routine, legitimate software behavior and don't indicate compromise or C2 activity.
• C (CPU temperature logs): Hardware metrics are unrelated to network communications; C2 is a network-layer concern.
• D (Email content filters): These detect phishing/malware delivery (initial infection vector), not the ongoing C2 channel established after infection.

Memory tip: Think "C2 = Call home secretly" - attackers encrypt their C2 traffic to hide it, so encrypted traffic patterns (timing, frequency, destinations) are the analyst's main signal. If it's encrypted and beaconing regularly to an unknown IP, that's your red flag.

No community discussion yet for this question.