At a logistics hub, analysts must separate command and control from ransomware and from other endpoint activity. Which event is the command-and-control activity?
Select an answer to reveal the explanation.
Short Explanation
A courier who keeps coming back for the next assignment is not the person who padlocked the warehouse. You want the repeating outbound beacon that fetches tasks, which is command and control. The trap is encrypted files with a payment note, a smashed stack, or a password someone forwarded.
Full Explanation
Command and control is the channel an implanted host uses to fetch tasking after the initial compromise. The event that matches is A repeating outbound beacon from a host that fetches new tasks from a rare address. Files on a share encrypted in place, with a note that demands payment to restore them, are ransomware, the outcome this question says to separate from command and control. A smashed stack inside one process, the memory corruption that can start an intrusion, can be the exploit that began the incident and is not itself the beacon. A user who forwarded a password to someone who asked for it over the phone or in mail handed over a credential and did not open a tasking channel. Sort the beacon by what it does after unwanted code is already running: it calls out and collects the next instruction from that rare address. Exam caveat: command and control can follow an earlier memory corruption; do not label the smashed stack as the beacon just because it came first. Operational check: group that host's outbound flows by destination and confirm tasking returns from the same rare address on a repeating rhythm.