352-001 · Question #239
Which two actions can the sinkhole technique be used to perform? (Choose two.)
The correct answer is B. redirect an attack away from its target C. monitor attack noise, scans, and other activity. A sinkhole redirects malicious or unwanted traffic to a controlled destination and allows analysts to monitor that traffic, making B and C the correct answers.
Question
Which two actions can the sinkhole technique be used to perform? (Choose two.)
Options
- Adelay an attack from reaching its target
- Bredirect an attack away from its target
- Cmonitor attack noise, scans, and other activity
- Dreverse the direction of an attack
How the community answered
(30 responses)- A3% (1)
- B93% (28)
- D3% (1)
Why each option
A sinkhole redirects malicious or unwanted traffic to a controlled destination and allows analysts to monitor that traffic, making B and C the correct answers.
A sinkhole does not delay an attack - it redirects traffic immediately with no buffering or time-delay mechanism involved.
A sinkhole works by altering DNS records or routing entries so that traffic bound for a malicious or attacked destination is diverted to a controlled server, effectively pulling the attack away from its intended target.
Because all redirected traffic lands on the sinkhole server, security teams can inspect it to observe attack patterns, scan behavior, botnet callbacks, and other malicious activity in a controlled and safe environment.
A sinkhole does not reverse the direction of an attack back toward the attacker; it simply diverts traffic to a controlled monitoring point without retaliating.
Concept tested: DNS and IP sinkhole technique for attack redirection and monitoring
Source: https://www.cisco.com/c/en/us/about/security-center/intelligence-group/threat-research/sinkholes.html
Topics
Community Discussion
No community discussion yet for this question.