Analyzing C2 traffic data to determine the infection stage often involves looking for:

Question

Options

• APeriodic access to social media sites
• BRegular beaconing intervals
• COccasional use of VPN services
• DSporadic email checking patterns

• A
  3% (1)
• B
  84% (27)
• C
  3% (1)
• D
  9% (3)

Explanation

Regular beaconing is the hallmark of C2 communication because malware must "phone home" to its command server at predictable intervals to receive instructions, exfiltrate data, or signal that the host is still compromised - this rhythmic pattern is what analysts look for to identify the infection stage and how long a host has been under attacker control.

Why the distractors are wrong:

• A (Social media): Legitimate user behavior, not a C2 indicator - though some advanced malware does abuse social media for covert channels, periodic access to it is not a reliable infection-stage signal.
• C (VPN use): Also normal user activity; VPNs might obscure C2 traffic but aren't themselves the traffic pattern analysts analyze.
• D (Sporadic email checking): "Sporadic" is the key problem - C2 beaconing is regular, not random. Irregular patterns are harder to detect and less diagnostic.

Memory tip: Think of C2 beaconing like a heartbeat monitor - a healthy (attacker-controlled) implant beats at regular intervals. If you see a clock-like rhythm in outbound connections, that's your C2 tell.

No community discussion yet for this question.