Unchanged default passwords are the likely cause when a NATed storage appliance shows foreign files and traffic
Given a scenario, troubleshoot security issues.
AnswerCorrect answer: A — A public-facing appliance still using its default password is routinely found by scanners, explaining both the foreign files and the traffic spike.
A cloud engineer has deployed a virtual storage appliance into a public cloud environment. The storage appliance has a NAT to a public IP address. An administrator later notices there are some strange files on the storage appliance and a large spike in network traffic on the machine. Which of the following is the most likely cause?
The default password is still configured on the appliance. Correct Answer
The appliance’s certificate has expired.
The storage appliance has no firewall.
Data encryption is enabled, and the files are hashed.
67% of anonymous learners picked answer A.
Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
Strange files plus egress-bound traffic on a newly public appliance is the signature of takeover via default or weak credentials, not a certificate or encryption behavior issue.
A virtual storage appliance reachable through a public IP shows unknown files and a network traffic spike. Appliances left with factory default credentials are routinely found and compromised by internet scanners, which explains both the written files and the elevated traffic in one cause.
Choosing no firewall (C) misreads NAT: the appliance is not directly exposed with zero filtering, and the scenario gives no evidence of an absent firewall, while default credentials explain the specific symptoms.
Community Discussion (5 comments)
BigM👍 1Selected: A
Explanation: If the storage appliance is exposed to the public internet via a NATed public IP, and an administrator notices strange files and a spike in network traffic, the most likely cause is that the default password was never changed. Attackers scan public IPs for appliances with default credentials. Many virtual storage appliances ship with weak or known default credentials, making them easy targets. Once compromised, the appliance could be used for data exfiltration, cryptojacking, or hosting malicious files, explaining the spike in network traffic.
WereAllinThisTogether👍 1
C. Keyword is "just deployed" no other deployments are essentially in this public cloud environment as well we can assume. We do not know what could be doing the NAT as well. Most likely this is a DDoS attack occurring and infiltration because of the weird files. We can assume no firewall was protecting this asset against these attacks.
geocis👍 1Selected: C
The storage appliance having a NAT to a public IP only indicates the appliance private IP is translated to a public IP for external access. Going with C.
st1a👍 3Selected: A
If it is nat, it is already behind a firewall. Going with default password
CXSSP👍 1Selected: C
C. The storage appliance has no firewall.
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Log in to comment, report an error, or add a note about this question.
Expert Analysis
Why the Answer Is Correct
Attackers continuously sweep public address space for management interfaces that still answer with factory credentials, and storage appliances are a known target class. A successful login with a default password produces exactly this evidence: attacker-written files in the storage and a traffic spike as data is exfiltrated or the box is enlisted in further scanning. One unpatched configuration default accounts for both symptoms, which is why it is the most likely cause.
Why the Other Options Are Wrong
B, an expired certificate, would break TLS sessions and produce connection errors, not new files or a traffic surge. C, having no firewall, is not supported by the scenario: the appliance sits behind NAT to a public IP, which already implies address translation and filtering at the boundary, and a missing firewall alone does not write files. D, enabled encryption with hashed files, describes normal appliance behavior and would neither invite access nor raise traffic.
Community Comment Notes
st1a makes the decisive point that NAT already places the appliance behind a firewall, so the default password is the open door. BigM explains that attackers scan public IPs for appliances with unchanged default credentials, which matches the strange files and spike. WereAllinThisTogether and geocis push C on exposure grounds, but CXSSP and the vote weight side with the credential explanation, which also accounts for both symptoms at once.