Question

While reviewing proxy logs, an analyst notices repeated outbound HTTP requests to several external hosts. Most legitimate browser traffic shows user-agent strings referencing Mozilla, Chrome, or Safari versions. However, a subset of requests from a single internal workstation contains the user-agent string 'python-requests/2.28.1' occurring at regular 60-second intervals. Which conclusion is best supported by this observation?

Accepted Answer

The workstation is likely running a scripted client or automated tool that may indicate command-and-control or unauthorized automation activity

Answer

The traffic represents normal browser caching behavior and can be safely ignored

Answer

The user-agent proves the workstation has been physically compromised by an insider threat

Answer

The requests are TLS-encrypted and therefore cannot be malicious