Question

A SOC analyst reviewing firewall logs notices that an internal workstation initiates outbound HTTPS connections to the same external IP address every 300 seconds, with each connection transferring a nearly identical small payload of approximately 512 bytes. The destination domain was registered three days ago and has no reputation data. Which conclusion is BEST supported by these indicators?

Accepted Answer

The workstation is exhibiting command-and-control beaconing behavior and should be investigated as a compromised host

Answer

The traffic represents normal software update checks and can be safely ignored

Answer

The workstation is performing a volumetric DDoS attack against the external IP

Answer

The activity indicates data exfiltration of a large database to the external host