A user is flagged for consistently consuming a high volume of network bandwidth over the past week. During the investigation, the security analyst finds traffic to the following websites: Which of…

The correct answer is D. grnail.com. The traffic to grnail.com (a likely typo-squatted domain mimicking gmail.com) shows a suspicious pattern: low inbound (1250 bytes) and high outbound (525,984 bytes) data. This suggests potential data exfiltration, which poses a greater security risk than simple high-bandwidth…

Submitted by stefanr· Mar 6, 2026Security operations

Question

A user is flagged for consistently consuming a high volume of network bandwidth over the past week. During the investigation, the security analyst finds traffic to the following websites:

Which of the following data flows should the analyst investigate first?

Exhibit

Options

Anetflix.com
Byoutube.com
Ctiktok.com
Dgrnail.com
Etranslate.google.com
Foffice.com

How the community answered

(36 responses)

A
11% (4)
B
6% (2)
C
3% (1)
D
78% (28)
E
3% (1)

Explanation

The traffic to grnail.com (a likely typo-squatted domain mimicking gmail.com) shows a suspicious pattern: low inbound (1250 bytes) and high outbound (525,984 bytes) data. This suggests potential data exfiltration, which poses a greater security risk than simple high-bandwidth media

Topics

#Network traffic analysis#Typosquatting#Phishing#Malware

Community Discussion

No community discussion yet for this question.

Full CS0-003 Practice