What technique is not used to break the command-and-control (C&C) phase of the Cyber-Attack Lifecycle?

Question

Options

• Ablocking outbound traffic to known malicious sites and IP addresses
• Bvulnerability and patch management
• CDNS monitoring and DNS poisoning
• Dall of the above

• A
  7% (2)
• B
  83% (24)
• C
  3% (1)
• D
  7% (2)

Explanation

Vulnerability and patch management addresses the exploitation phase of the attack lifecycle - closing security gaps before attackers can get a foothold - not the communication channel that malware uses after it's already installed. Once an attacker has established C&C, patching systems doesn't sever that connection.

Options A and C are both valid C&C disruption techniques, which is why D ("all of the above") is also wrong:

• Blocking outbound traffic to malicious IPs/domains directly cuts the line between infected hosts and the attacker's server.
• DNS monitoring detects beacon-style lookups to C&C domains, and DNS poisoning/sinkholing redirects those queries to a controlled server, effectively blinding the attacker.

Memory tip: The C&C phase is about communication, so ask yourself - "does this technique disrupt a network conversation?" Blocking traffic and DNS manipulation both answer yes. Patching answers no, because it prevents entry, not communication - it belongs one step earlier in the lifecycle.

No community discussion yet for this question.