Security Monitoring →mediumMultiple ChoiceObjective-mapped

200-201 Security Monitoring Practice Question

A network analyst notices that a host is sending a large volume of traffic to an external IP address on port 443 during non-business hours. The traffic volume is significantly higher than the established baseline. Which type of data exfiltration technique should be suspected?

⚠ Common exam trap

Cisco often tests the association of common protocols with their default ports; the trap here is that candidates might see 'large volume of traffic' and immediately think of HTTP post (option A) without noticing the port number 443, which clearly indicates encrypted HTTPS traffic.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

HTTPS exfiltration

Port 443 is the default port for HTTPS (HTTP over TLS). The large volume of traffic during non-business hours, exceeding the baseline, strongly suggests the attacker is using encrypted HTTPS connections to hide data exfiltration. Unlike plaintext HTTP, HTTPS encryption makes it difficult for network monitoring tools to inspect the payload, allowing the attacker to blend malicious traffic with legitimate encrypted web traffic.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
HTTP post
Why it's wrong here
HTTP post on port 80 is unencrypted but less common for large volumes.
✓
HTTPS exfiltration
Why this is correct
HTTPS provides encryption, making detection harder, and large volumes are suspicious.
✗
ICMP tunneling
Why it's wrong here
ICMP tunneling uses ping packets, typically low volume.
✗
DNS tunneling
Why it's wrong here
DNS tunneling uses DNS queries/responses to exfiltrate data, typically low volume.

Go deeper

200-201 Security Monitoring Practice Question

Why each option matters

Option-by-option breakdown

Related to this question