IPA FE Subject A sample Question 31
A question IPA Japan published in 基本情報技術者試験 科目A サンプル問題 問31, translated into English. ITPEC is based on the same exams.
Which of the following is an appropriate role of a C&C server in a botnet?
Explanation
Sending commands to hijacked computers and receiving their responses — the C&C (command and control) server is the attacker’s control point of a botnet.
A botnet is a group of computers infected with bot malware. Each bot connects out to the C&C server, receives the attacker’s instructions (send spam, join a DDoS attack, steal data, download more malware) and reports results back. Because the bots connect outward, the traffic often passes a firewall, so blocking known C&C addresses or spotting the periodic beacon traffic is a key countermeasure.
Answer (d)
Why not others:
- •(a) — caching content and delivering it on behalf of the origin server to reduce load is a cache server (reverse proxy or CDN edge)
- •(b) — relaying authentication protocols such as CHAP for remote access is the job of a remote access (RADIUS-type) server, not an attacker’s tool
- •(c) — issuing time-synchronized one-time passwords for remote access is an authentication server for token-based login
Key rule: C&C server = the attacker’s command post: bots poll it for commands and send it their results; finding and blocking that traffic cuts the botnet off.
Security · AI-written, may contain errors
This question comes from the past questions IPA Japan publishes, translated into English by ITPEC Practice. ITPEC Practice is an independent study tool and is not affiliated with IPA or ITPEC. See the original paper (PDF) or Report an issue.