A security analyst is reviewing packet captures from a system that was compromised.

The system was already isolated from the network, but it did have network access for a few hours after being compromised.

When viewing the capture in a packet analyzer, the analyst sees the following:

Which of the following can the analyst conclude?

Question

A security analyst is reviewing packet captures from a system that was compromised.

The system was already isolated from the network, but it did have network access for a few hours after being compromised.

When viewing the capture in a packet analyzer, the analyst sees the following:

Which of the following can the analyst conclude?

Exam-Answer · Accepted Answer

Data is being exfiltrated over DNS.

Question 14 of 160 from exam CS0-002: CompTIA CySA+