Cert Master

KT-NET Beaconing

A host contacts one IP every 60 seconds with 200-byte HTTPS posts. Likely behavior?

Multiple choice — select one answer

Answer choices

  1. a. Backup tape rotation, without security or identity team coordination per policy.
  2. b. User reading news, without security or identity team coordination per policy.
  3. c. C2 beaconing with jittered interval—investigate process and block domain
  4. d. Windows Update always, without security or identity team coordination per policy.

Architectural breakdown & explanation

Regular small outbound sessions are beacon patterns.

Correct answer(s): c. C2 beaconing with jittered interval—investigate process and block domain

Exam domain: Beaconing (17% weight on the official guide).

Official documentation & study links

Practice this certification

This page is one question from the KeyTrain's Key Training — Network Security bank. Run a full timed practice exam with domain-weighted random questions in your browser.

Start practice exam View exam overview All certifications