Match each detection pattern to the most likely security issue. Each item has one best match.
Drag a concept onto its matching description — or click a concept then click the description.
Living-off-the-land or fileless malware execution
DNS tunneling or command-and-control beaconing
Password spraying or credential stuffing that succeeded
Compromised privileged credentials with persistence and post-exploitation activity
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Repeated login failures: Brute-force attack
Repeated login failures indicate brute-force; Outbound connections to malicious IPs suggest C2; Large data transfers at odd hours indicate exfiltration; Random DNS subdomains are typical of tunneling; Conflicting ARP replies show spoofing; Multiple ICMP requests from many sources indicate DDoS.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
Repeated login failures: Brute-force attack
Why this is correct
Repeated login failures are a hallmark of an automated brute-force attempt, where an attacker cycles through many guessed username/password pairs against an authentication endpoint. Unlike a single typo, these failures cluster in a short time window and often come from a single source IP or a distributed pool. Monitoring failed-auth logs, lockout thresholds, and source IP reputation provides direct evidence of credential guessing.
Outbound connections to malicious IPs: Command and Control (C2)
Why this is correct
Outbound connections to known malicious IP addresses, especially at regular intervals, indicate a compromised host’s command-and-control (C2) channel. A C2 protocol typically involves beaconing — periodic check-ins over HTTP, HTTPS, or DNS — to receive instructions or stage stolen data for later retrieval. Egress filtering and threat-intelligence feeds flag these destination IPs, revealing the compromised host.
Large data transfers at odd hours: Data exfiltration
Why this is correct
A sudden surge in data transfers to external destinations during odd hours deviates from established user and host baselines, pointing strongly to data exfiltration. Attackers deliberately schedule bulk copying when administrative oversight is low, often compressing or encrypting the data to evade content inspection. Security monitoring with user and entity behavior analytics (UEBA) can trigger on volume, destination, and time anomalies.
Multiple ICMP requests from many sources: DDoS
Why this is correct
An ICMP flood composed of requests from many distributed source addresses is a classic volumetric distributed denial-of-service (DDoS) attack. The goal is to saturate the target’s bandwidth or processing capacity with echo requests, rendering services unavailable. The distributed, high-quantity nature distinguishes it from a single-host ping sweep or host discovery.
Random DNS subdomains: DDoS
Why it's wrong here
Randomly generated DNS subdomains are not a DDoS indicator; instead, they are the signature of DNS tunneling, where the attacker encodes data in query names and responses to bypass firewall controls. DDoS attacks overwhelm with traffic volume or amplification, whereas tunneling produces low, stealthy query rates. Misclassifying these subdomains as DDoS leads responders to add rate limits rather than inspect DNS payloads.
Conflicting ARP replies: Data exfiltration
Why it's wrong here
Conflicting ARP replies — where multiple hosts answer for the same IP address — are a sign of ARP spoofing in a local network, not data exfiltration. An attacker spoofs the gateway MAC to redirect traffic so they can intercept, modify, or sniff packets in a man-in-the-middle position. This is a network-layer integrity issue, whereas data exfiltration is an outbound data-flow anomaly; confusing them misdirects containment efforts.
Go deeper
Learn chapter
Data Exfiltration Detection
Key term
IPS
An Intrusion Prevention System (IPS) is a network security device that monitors traffic in real time and automatically blocks threats before they reach your systems.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,030 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.