A cybersecurity analyst is investigating a potential incident affecting multiple systems on a company's internal network. Although there is a negligible impact to performance, the following symptoms are present on each of the affected systems: Existence of a new and unexpected svchost.exe process Persistent, outbound TCP/IP connections to an unknown external host with routine keep-alives transferred DNS query logs showing successful name resolution for an Internet-resident dynamic DNS domain If this situation remains unresolved, which of the following will MOST likely occur?
A) The affected hosts may participate in a coordinated DDoS attack upon command
B) An adversary may leverage the affected hosts to reconfigure the company's router ACLs
C) Key files on the affected hosts may become encrypted and require ransom payment for unlock
D) The adversary may attempt to perform a man-in-the-middle attack

Question

Quizplus · Accepted Answer

The symptoms suggest that the affected systems are part of a botnet, which can be used to participate in coordinated DDoS attacks upon command.

A Cybersecurity Analyst Is Investigating a Potential Incident Affecting Multiple