What is a botnet and how do attackers typically control infected machines?

• A. A private network used by organizations to isolate infected hosts.
• B. A network of compromised devices under centralized control, often via a command-and-control server or peer-to-peer protocol.
• C. A set of devices that are immune to malware due to updated patches.
• D. A malware type that only operates on servers.

Answer: (B)

A botnet is a network of compromised devices under centralized control, often via a command-and-control server or a peer-to-peer protocol. Attackers gain control by installing malware on many devices—computers, IoT, and other internet-connected gear—that then connect back to the control infrastructure. The attacker (the botmaster) can issue commands to these infected machines, which carry out coordinated actions like launching distributed denial-of-service attacks, stealing data, or sending spam. In a centralized setup, the command-and-control server acts as the hub that sends instructions and collects results; in a peer-to-peer setup, each infected device relays commands to others, making takedowns harder because there isn’t a single point of failure.

Infections typically happen through phishing emails, drive-by downloads, or exploiting software vulnerabilities, after which the malware runs covertly in the background. The key idea is that many compromised devices are pooled together to act as a single, controllable network that attackers can deploy for harmful purposes. The other options don’t fit because a botnet isn’t a private network used to isolate infected hosts, it doesn’t imply immunity from malware, and it isn’t limited to servers.