CompTIA CySA+ (CS0-001) — Question 136

Ransomware is identified on a company's network that affects both Windows and MAC hosts. The command and control channel for encryption for this variant uses TCP ports from 11000 to 65000. The channel goes to good1. Iholdbadkeys.com, which resolves to IP address 72.172.16.2.
Which of the following is the MOST effective way to prevent any newly infected systems from actually encrypting the data on connected network drives while causing the least disruption to normal Internet traffic?

Answer options

• A. Block all outbound traffic to web host good1 iholdbadkeys.com at the border gateway.
• B. Block all outbound TCP connections to IP host address 172.172.16.2 at the border gateway.
• C. Block all outbound traffic on TCP ports 11000 to 65000 at the border gateway.
• D. Block all outbound traffic on TCP ports 11000 to 65000 to IP host address 172.172.16.2 at the border gateway.

Correct answer: A

Explanation

Blocking all outbound traffic to the web host good1.iholdbadkeys.com at the border gateway (Option A) is the most effective measure because it cuts off the ransomware's command and control communication entirely, preventing encryption of data. The other options either block traffic to a specific IP (B), or only limit the traffic on certain ports (C and D), which may still allow some ransomware activity to occur.