An endpoint, inside an organization, is infected with known malware that attempts to make a command-and-control connection to a C2 server via the destination IP address
Which mechanism prevents this connection from succeeding?
This is a good test of our network security knowledge. I think the key is to focus on the fact that the malware is trying to make an outbound connection, so the solution would likely involve some kind of network-level control or monitoring to detect and block that activity. DNS sinkholing seems like the most straightforward approach.
I'm a little confused by the wording of the question. Is it asking about a specific mechanism, or just any mechanism that could prevent the connection? I want to make sure I understand the scope before I commit to an answer.
DNS sinkholing seems like the most likely answer here. By redirecting the malware's attempt to connect to the C2 server to a controlled server instead, it would effectively block the connection from succeeding. The other options don't seem as directly relevant to this specific scenario.
Hmm, I'm a bit unsure about this one. There are a few options that seem plausible, but I'm not totally confident in my understanding of how each one would work to prevent the connection. I'll need to think it through carefully.
This seems like a straightforward question about network security mechanisms. I think the key is to focus on the fact that the malware is trying to make a command-and-control connection, so the solution would likely involve some kind of network-based control or monitoring.
Ciara
5 days agoFrance
11 days agoRory
17 days agoVallie
22 days agoJanessa
27 days agoKatie
1 month agoKimberlie
1 month agoGermaine
2 months agoOllie
2 months agoUlysses
3 months ago