Match each detection pattern to the most likely security issue. Each item has one best match.
Drag a concept onto its matching description — or click a concept then click the description.
Living-off-the-land or fileless malware execution
DNS tunneling or command-and-control beaconing
Password spraying or credential stuffing that succeeded
Compromised privileged credentials with persistence and post-exploitation activity
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Repeated login failures: Brute-force attack
Repeated login failures indicate brute-force; Outbound connections to malicious IPs suggest C2; Large data transfers at odd hours indicate exfiltration; Random DNS subdomains are typical of tunneling; Conflicting ARP replies show spoofing; Multiple ICMP requests from many sources indicate DDoS.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
Repeated login failures: Brute-force attack
Why this is correct
Repeated login failures are a hallmark of an automated brute-force attempt, where an attacker cycles through many guessed username/password pairs against an authentication endpoint. Unlike a single typo, these failures cluster in a short time window and often come from a single source IP or a distributed pool. Monitoring failed-auth logs, lockout thresholds, and source IP reputation provides direct evidence of credential guessing.
Outbound connections to malicious IPs: Command and Control (C2)
Why this is correct
Outbound connections to known malicious IP addresses, especially at regular intervals, indicate a compromised host’s command-and-control (C2) channel. A C2 protocol typically involves beaconing — periodic check-ins over HTTP, HTTPS, or DNS — to receive instructions or stage stolen data for later retrieval. Egress filtering and threat-intelligence feeds flag these destination IPs, revealing the compromised host.
Large data transfers at odd hours: Data exfiltration
Why this is correct
A sudden surge in data transfers to external destinations during odd hours deviates from established user and host baselines, pointing strongly to data exfiltration. Attackers deliberately schedule bulk copying when administrative oversight is low, often compressing or encrypting the data to evade content inspection. Security monitoring with user and entity behavior analytics (UEBA) can trigger on volume, destination, and time anomalies.
Multiple ICMP requests from many sources: DDoS
Why this is correct
An ICMP flood composed of requests from many distributed source addresses is a classic volumetric distributed denial-of-service (DDoS) attack. The goal is to saturate the target’s bandwidth or processing capacity with echo requests, rendering services unavailable. The distributed, high-quantity nature distinguishes it from a single-host ping sweep or host discovery.
Random DNS subdomains: DDoS
Why it's wrong here
Randomly generated DNS subdomains are not a DDoS indicator; instead, they are the signature of DNS tunneling, where the attacker encodes data in query names and responses to bypass firewall controls. DDoS attacks overwhelm with traffic volume or amplification, whereas tunneling produces low, stealthy query rates. Misclassifying these subdomains as DDoS leads responders to add rate limits rather than inspect DNS payloads.
Conflicting ARP replies: Data exfiltration
Why it's wrong here
Conflicting ARP replies — where multiple hosts answer for the same IP address — are a sign of ARP spoofing in a local network, not data exfiltration. An attacker spoofs the gateway MAC to redirect traffic so they can intercept, modify, or sniff packets in a man-in-the-middle position. This is a network-layer integrity issue, whereas data exfiltration is an outbound data-flow anomaly; confusing them misdirects containment efforts.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: May 17, 2026
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.