At a bank, after the initial infection, a host calls the same rare address every few minutes and receives tasking back. Which attack stage is that repeating exchange?
Select an answer to reveal the explanation.
Short Explanation
After the burglar is inside, the phone calls home for instructions. You are watching command and control: a repeating call to one rare address that returns tasking. The trap is naming the overflow that may have started it, a website injection, or a certificate renewal.
Full Explanation
Command and control is the stage after a host is already infected, when the implant calls an outside address and receives instructions. This bank host calls the same rare address every few minutes and gets tasking back, which is that stage rather than the initial exploit. The interval is a description of this case, not a required timer. The stage is "Command and control, the post-infection stage where the host repeatedly calls one rare address and receives tasking". "The buffer overflow that may have been the initial infection, before this host began calling back" may explain how the host was compromised, and it is not the repeating callback the question asks about. "A SQL injection on a public bank site, separate from this host calling out for tasking" is a web input attack on an application, and nothing here describes a database query or a public site. "A routine certificate renewal on the bank web server, with no tasking sent back to the host" is certificate maintenance, and a renewal does not return tasking to an infected host. Exam caveat: the callback does not identify the earlier exploit, so do not collapse command and control into the buffer overflow that may have preceded it. Operational check: record the 5-tuple and the observed interval, compare the rare destination with the host's normal profile, and keep a packet or log sample of the tasking before you block the address.