350-701 Security Concepts Practice Question
A security analyst notices unusual outbound traffic from an internal host to a known malicious IP address on TCP port 4444. The host is also exhibiting high CPU usage and running an unknown process. Which type of malware is most likely present?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Remote Access Trojan (RAT)
A RAT (Remote Access Trojan) often uses a command-and-control (C2) channel on high-numbered ports like 4444, allowing attackers to control the host remotely.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Ransomware
Why it's wrong here
Ransomware typically encrypts files and demands payment, but does not usually establish a persistent C2 channel on port 4444 with outbound traffic.
- ✗
Botnet C2 client
Why it's wrong here
A botnet C2 client could use port 4444, but the term is broader; however, a RAT is a specific type of malware that provides remote control.
- ✓
Remote Access Trojan (RAT)
Why this is correct
RATs commonly use ports like 4444 for C2 communication, allowing remote control and data exfiltration.
- ✗
Keylogger
Why it's wrong here
Keyloggers capture keystrokes and may exfiltrate data, but they do not typically cause high CPU usage or use port 4444 for C2.
Go deeper
Related to this question
About these practice questions
This 350-701 question is part of Courseiva's 978-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.