What is a recommended mitigation strategy to block Command and Control (C2) traffic?

Question

Options

• ADecreasing firewall security levels
• BImplementing stringent egress filtering
• CAllowing all outbound traffic
• DReducing the use of encryption

• A
  3% (1)
• B
  72% (23)
• C
  9% (3)
• D
  16% (5)

Explanation

Implementing stringent egress filtering (B) directly targets C2 traffic because malware must communicate outbound to attacker-controlled servers to receive instructions or exfiltrate data. By restricting and inspecting what traffic is allowed to leave the network - blocking unauthorized ports, suspicious domains, and unusual protocols - you sever the communication channel between compromised hosts and the attacker, neutralizing the C2 relationship even if a machine is already infected.

Why the distractors fail:

• A (Decreasing firewall security): The opposite of a mitigation - looser security gives C2 traffic more room to operate freely.
• C (Allowing all outbound traffic): Completely defeats egress filtering; malware can freely "phone home" with no restrictions.
• D (Reducing encryption): Irrelevant to blocking C2 and actively harms security posture; visibility into encrypted traffic (via SSL inspection) can aid detection, but reducing encryption itself does not block anything.

Memory tip: C2 = "Call out to Command." Since the malicious call goes out, you stop it at the exit - Egress filtering for Exit traffic.

No community discussion yet for this question.