200-201 Network Intrusion Analysis Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Large data transfers to a known cloud provider

  Why it's wrong here

  Beaconing consists of small, periodic check-in packets, not bulk exfiltration; large transfers to cloud providers describe data staging or exfiltration activity. It is tempting because both indicate compromise, but the distinguishing mechanism is timing regularity and payload size, which this option misstates.

• ✗

  ICMP echo requests to multiple hosts

  Why it's wrong here

  ICMP echo requests to multiple hosts describe network reconnaissance or ping sweeps, not C2 beaconing, which uses repeated connections to a single external endpoint. It is tempting because both are suspicious network patterns, but beaconing's defining mechanism is periodic callback to one controller.

• ✗

  Random intervals with varying packet sizes

  Why it's wrong here

  Beaconing uses regular, predictable intervals with small, consistent packet sizes; random intervals and varying sizes describe normal or evasive traffic instead. It is tempting because jitter can be added to evade detection, but the typical signature remains periodic timing, which this option contradicts.

• ✓

  Periodic connections at regular intervals to an external IP

  Why this is correct

  Beaconing malware checks in with its command and control server on a fixed schedule, producing repeated connections to the same external IP at consistent intervals. This regularity, rather than payload content or port choice, is the defining signature analysts use to distinguish beaconing from normal traffic.

Go deeper

Related to this question