MENU
Refer to the exhibit.
According to the Wireshark output, what is the Indicator of Attack?
The capture shows one source, 207.86.6.174, sending a rapid sequence of DNS queries to 205.94.14.222. The timestamps progress by roughly 0.04 seconds, producing dozens of requests in little more than one second. That unusually high request rate is the observable Indicator of Attack; the exhibit does not establish that the queried domains are malicious. Requesting several DNS record types can occur legitimately, so option B is descriptive but not the strongest attack indicator. Option A ignores the abnormal frequency. CBRFIR Forensics Processes objective 4.3 requires analysts to examine traffic associated with malicious activity using network-monitoring tools and Wireshark display analysis. The defensible conclusion must therefore remain tied to what the packet evidence directly proves: a DNS-query burst from a single host, which warrants correlation with baseline, endpoint, and threat-intelligence data. Cisco CBRFIR v1.2 exam topics
================