Question

A security analyst is examining suspicious network-traffic patterns in a segmented environment. During a 2-hour period, the analyst identifies this event sequence: an external IP address scans multiple ports on a web server, followed by a surge of HTTP requests with unusually large payloads. Shortly afterward, the database server exhibits anomalous outbound traffic over an unencrypted channel to that same external IP. In addition, DNS queries resolving to previously unknown domains increase sharply. How should the analyst interpret this sequence of events?

Accepted Answer

D. reconnaissance followed by a SQL injection attack on the web server, leading to data exfiltration from the database

Answer

initial scanning, followed by a DDOS attack on the web server, and continuing by lateral movement to the database server

Answer

brute force attack on the web server, followed by a DDOS, proceeded by DNS tunneling used to exfiltrate sensitive data

Answer

lateral attack targeting internal users, followed by privilege escalation to the web server, continuing to the database exfiltration