Palo Alto Networks Certified Cybersecurity Entry-level Technician (PCCET)Network SecurityMedium
A small business is experiencing slow internet speeds and suspicious network activity. Upon investigation, the IT administrator discovers that one of the employee's computers has been infected with a botnet client, which is participating in a Distributed Denial of Service (DDoS) attack against an external target. The botnet client is also attempting to spread to other internal machines. Which network security concept describes the infected employee's computer within this botnet infrastructure?
- AJump Server
- BBastion Host
- CZombie (Bot)
- DHoneypot
Show answer & explanationAnswer & explanation
Correct answer: C. Zombie (Bot)
In a botnet, an infected computer that is controlled by a command-and-control server and participates in malicious activities (like DDoS attacks) is referred to as a 'zombie' or 'bot'.
Why the other options are wrong
- A. A jump server is a secure intermediary machine used to access other devices, not a botnet participant.
- B. A bastion host is a hardened server in a DMZ, designed to withstand attacks, not an infected endpoint.
- D. A honeypot is a decoy system used to attract and study attackers, not an infected machine in a botnet.
Zombie (Bot)
A compromised computer connected to the internet that has been infected with malware and can be controlled remotely by an attacker, typically as part of a botnet.
- Used to perform malicious tasks like DDoS attacks, spamming, or cryptomining.
- Controlled by a command-and-control (C2) server.
- Often unaware of its compromised status.
Memory trick: A botnet is an army of zombies (bots) controlled by a sinister brain (C2).