Jim works as a security analyst in a large multinational company. Recently, a group of hackers penetrated into their organizational network and used a data staging technique to collect sensitive…

Question

Options

• AJim should identify the attack at an initial stage by checking the content of the user agent field.
• BJim should analyze malicious DNS requests, DNS payload, unspecified domains, and destination
• CJim should monitor network traffic for malicious file transfers, file integrity monitoring, and event
• DJim should identify the web shell running in the network by analyzing server access, error logs,

• A
  4% (1)
• B
  7% (2)
• C
  74% (20)
• D
  15% (4)

Explanation

Data staging is the phase where attackers collect, compress, and organize stolen data internally before moving it out. Option C is correct because staging activity is visible through abnormal internal file transfers (bulk copying/compression), file integrity changes (new archives, modified directories), and event logs (unusual access patterns and timestamps) - all direct indicators of data being aggregated and prepared for exfiltration.

Option A is wrong because checking user agent strings detects malicious web requests or browser-based exploits, relevant to the initial access phase, not staging.

Option B is wrong because analyzing DNS requests/payloads targets C2 communications or DNS tunneling during exfiltration, not the internal staging behavior that precedes it.

Option D is wrong because analyzing server access and error logs to find web shells addresses persistence/initial compromise, a much earlier phase of the attack lifecycle.

Memory tip: Think of staging like a heist crew loading a getaway van inside a warehouse - you catch them before they drive away by watching for unusual movement inside (file transfers + integrity alerts + events), not by watching the exits (DNS/exfiltration) or how they broke in (web shells/user agents).

No community discussion yet for this question.