300-220 · Question #50
Selecting suspicious activity often involves analyzing session and protocol data. Which protocol is commonly scrutinized for this purpose?
The correct answer is D. All of the above. All three protocols - SMTP, FTP, and HTTP - are routinely analyzed for suspicious activity, making "All of the above" the correct choice. SMTP (email) is scrutinized for phishing, spam campaigns, and data exfiltration via email attachments. FTP is monitored because it transmits…
Question
Selecting suspicious activity often involves analyzing session and protocol data. Which protocol is commonly scrutinized for this purpose?
Options
- ASMTP
- BFTP
- CHTTP
- DAll of the above
How the community answered
(25 responses)- B8% (2)
- C4% (1)
- D88% (22)
Explanation
All three protocols - SMTP, FTP, and HTTP - are routinely analyzed for suspicious activity, making "All of the above" the correct choice. SMTP (email) is scrutinized for phishing, spam campaigns, and data exfiltration via email attachments. FTP is monitored because it transmits credentials in plaintext and is commonly exploited for unauthorized file transfers or malware staging. HTTP is perhaps the most analyzed of all, as it carries web traffic that can hide command-and-control communications, data exfiltration, and malicious payloads.
The distractors (A, B, C individually) are wrong not because those protocols are unimportant, but because choosing any single one implies the others are not scrutinized - which is false in real-world security monitoring.
Memory tip: Think "SFH - Security Flags High." All three (SMTP, FTP, HTTP) are legacy, widely-used protocols with known weaknesses, so security teams watch all of them. When an exam question lists common protocols and offers "All of the above," be suspicious of answers that exclude any well-known protocol from scrutiny.
Topics
Community Discussion
No community discussion yet for this question.