ISC2 CC Network Security Practice Question
A company uses a SIEM to monitor network security events. The security analyst notices a high volume of alerts about suspicious outbound traffic to a known command-and-control server. The traffic is encrypted and uses non-standard ports. Which security control would best detect this activity if the SIEM relies only on network flow data?
⚠ Common exam trap
The trap here is assuming that encrypted traffic cannot be detected, when flow-based anomaly detection can identify malicious behavior from metadata alone.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Network flow analysis with anomaly detection
Since the SIEM only has network flow data and the traffic is encrypted, payload inspection is impossible. Network flow analysis with anomaly detection uses metadata like IP, port, and timing to identify beaconing patterns to known C2 servers. Signature IDS, host antivirus, and WAFs either need payload visibility or do not monitor outbound flows.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Web application firewall (WAF) in reverse proxy mode
Why it's wrong here
A WAF protects web applications by inspecting HTTP/HTTPS requests to the application, not outbound traffic from internal hosts to external C2 servers. It is placed in front of web servers and does not monitor general network flows. Therefore, it cannot detect the described outbound encrypted C2 communication.
- ✗
Host-based antivirus with heuristic scanning
Why it's wrong here
Host-based antivirus runs on endpoints and may detect malware, but it does not analyze network flows and cannot identify outbound C2 traffic from network metadata. It also requires the malware to be present and detectable on the host, which may not happen if the endpoint is compromised in a way that evades AV.
- ✗
Signature-based intrusion detection system (IDS)
Why it's wrong here
A signature-based IDS inspects packet payloads for known patterns, but the traffic is encrypted, so signatures cannot match content. It also may not correlate flow metadata to identify C2 behavior. While it can detect some unencrypted attacks, it is ineffective when the payload is encrypted and the SIEM only has flow data.
- ✓
Network flow analysis with anomaly detection
Why this is correct
Network flow analysis examines metadata such as IP addresses, ports, byte counts, and timing without needing payload decryption. Anomaly detection can flag deviations like regular beaconing to a known C2 IP on non-standard ports. This approach works with the SIEM's flow data and can detect encrypted C2 traffic based on behavioral patterns.
Go deeper
Related to this question
Learn chapter
Network Security Foundations
Key term
Terminal Access Controller Access-control System
TACACS+ is a remote authentication protocol that uses three separate servers to verify who you are, what you are allowed to do, and record what you did on network devices.
Key term
Analysis
In incident response, analysis is the process of examining data and events to determine what happened, how it happened, and what actions to take.
About these practice questions
This CC question is part of Courseiva's 989-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.