Security Monitoring →mediumMultiple ChoiceObjective-mapped

200-201 Security Monitoring Practice Question

A security analyst is reviewing firewall logs and notices a high number of denied outbound connections from an internal workstation to various external IP addresses on port 445 (SMB). What is the most likely explanation for this activity?

⚠ Common exam trap

Cisco often tests the association of specific ports with their services (e.g., SMB = 445) and expects candidates to recognize that anomalous outbound scanning on a file-sharing port indicates malware, not a benign application.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The workstation is infected with malware attempting to spread via SMB

Port 445 is used by SMB (Server Message Block) for file sharing and network communication. A high volume of denied outbound connections from a single workstation to many external IPs on this port is a classic indicator of malware attempting to propagate via SMB vulnerabilities, such as EternalBlue (MS17-010). Legitimate SMB traffic is typically confined to internal networks, not external scanning.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The user is browsing the web and the firewall is blocking HTTP
Why it's wrong here
HTTP uses port 80, not 445.
✗
The workstation is performing a DNS lookup
Why it's wrong here
DNS uses port 53.
✓
The workstation is infected with malware attempting to spread via SMB
Why this is correct
Many worms and ransomware use SMB to propagate.
✗
The workstation is performing a legitimate file transfer using FTP
Why it's wrong here
FTP uses ports 20/21, not 445.

Go deeper

200-201 Security Monitoring Practice Question

Why each option matters

Option-by-option breakdown

Related to this question