Which detection identifies an attack at the initial stage by analyzing the HTTP User-Agent header?

Which detection identifies an attack at the initial stage by analyzing the HTTP User-Agent header?

• A. Data Staging
• B. Command and Control Server
• C. HTTP User Agent Detection
• D. Use of DNS Tunneling Detection

Answer: (C)

Analyzing the HTTP User-Agent header lets you spot automated or malicious clients at the very first web interaction. Attackers often start with probes or basic requests from tools or compromised clients that reveal themselves through unusual, spoofed, or missing User-Agent strings. By detecting these anomalies in the User-Agent, you can flag an intrusion early, before deeper payloads or data exfiltration occur. The other options describe techniques used later in an attack or in different channels: data staging relates to preparing data for exfiltration, a command and control server refers to beaconing for remote control after access, and DNS tunneling involves covert data transfer over DNS—not the initial HTTP request signature.

Analyzing the HTTP User-Agent header lets you spot automated or malicious clients at the very first web interaction. Attackers often start with probes or basic requests from tools or compromised clients that reveal themselves through unusual, spoofed, or missing User-Agent strings. By detecting these anomalies in the User-Agent, you can flag an intrusion early, before deeper payloads or data exfiltration occur. The other options describe techniques used later in an attack or in different channels: data staging relates to preparing data for exfiltration, a command and control server refers to beaconing for remote control after access, and DNS tunneling involves covert data transfer over DNS—not the initial HTTP request signature.