Which security component can detect command-and-control traffic sent from multiple endpoints within a corporate data center?

The correct answer is B. next-generation firewall. A next-generation firewall (NGFW) operates at Layer 7 with deep packet inspection and application awareness, enabling it to identify and correlate suspicious traffic patterns - such as C2 beaconing - across multiple internal endpoints simultaneously. A stateless firewall (A)…

Network Security

Question

Which security component can detect command-and-control traffic sent from multiple endpoints within a corporate data center?

Options

Astateless firewall
Bnext-generation firewall
Cpersonal endpoint firewall
Dport-based firewall

How the community answered

(68 responses)

A
28% (19)
B
47% (32)
C
9% (6)
D
16% (11)

Explanation

A next-generation firewall (NGFW) operates at Layer 7 with deep packet inspection and application awareness, enabling it to identify and correlate suspicious traffic patterns - such as C2 beaconing - across multiple internal endpoints simultaneously. A stateless firewall (A) only filters based on packet headers without tracking connection state or application context, making it blind to behavioral patterns like C2 callbacks. A personal endpoint firewall (C) is host-based and scoped to a single device, so it cannot correlate traffic across multiple endpoints. A port-based firewall (D) is essentially a stateless firewall that filters on TCP/UDP port numbers alone, easily bypassed by C2 traffic using common ports like 80 or 443.

Memory tip: Think "Next-Gen = Network-wide intelligence" - only NGFWs have the cross-endpoint visibility and application-layer awareness needed to spot coordinated C2 communication patterns across a data center.

Topics

#NGFW#C&C Detection#Advanced Threat Detection#Data Center Security

Community Discussion

No community discussion yet for this question.

Full PCCSA Practice