A security analyst runs tcpdump on the 10.203.10.22 machine and observes thousands of packets as shown below: Which of the following activities explains the tcpdump output?

An incoming `nmap -sA` (ACK scan) would show many incoming packets to the 10.203.10.22 machine, typically for port scanning, not thousands of sustained outbound packets.

An `hping3 --udp` scan would typically show a flood of UDP packets, likely to various ports or destinations, characteristic of a scanning tool, which is distinct from persistent C2 communication.

While C2 communications involve traffic leaving the network, malware beaconing is a more specific and common form of C2 communication characterized by periodic, low-volume activity, making it a more precise fit for the described output.

Malware beaconing refers to the periodic, often low-volume communication sent from a compromised host to a command and control (C2) server to check for new instructions or confirm its active status. This type of traffic aligns with a compromised machine maintaining contact with its controller, which tcpdump would capture as repeated outbound connections from the internal host.