200-201 Network Intrusion Analysis Practice Question
An analyst observes a host making outbound connections to a server on TCP port 443, with traffic patterns showing small packets at regular 60-second intervals. The destination IP is in a country where the company does no business. Which THREE characteristics suggest this is C2 beaconing?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Small packet sizes at regular 60-second intervals
Beaconing often uses HTTPS to evade detection, has periodic regular intervals, and goes to unusual destinations. Small packets at fixed intervals are classic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Small packet sizes at regular 60-second intervals
Why this is correct
Correct. Regular periodic small packets indicate beaconing.
- ✗
Large file downloads
Why it's wrong here
Large downloads are more like exfiltration or updates.
- ✓
Destination IP in a foreign country with no business presence
Why this is correct
Correct. Unusual geolocation raises suspicion.
- ✓
Use of HTTPS (port 443)
Why this is correct
Correct. HTTPS is common for C2 to blend in.
- ✗
DNS queries for internal domains
Why it's wrong here
Internal DNS queries are normal for internal resources.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-201 question from scratch — 979 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.