thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Intermediate

Beaconing

Regular, periodic outbound communication from a compromised host to attacker command-and-control infrastructure.

Definition

Implants check in at set intervals, often with random jitter, to receive tasks. Analysts detect beaconing by looking for repetitive connections with consistent timing and size to rare destinations. Tools such as RITA and SIEM statistical queries help identify it.

Example

A workstation contacting the same rare IP every 300 seconds with 450-byte requests around the clock.

Exam tip

Consistent intervals to an uncommon external host is the beaconing indicator CySA+ expects you to spot.

Related terms