200-201 Security Monitoring Practice Question
A SOC analyst is reviewing firewall logs and sees repeated outbound connections from an internal server to an external IP on TCP port 443, but the traffic is not TLS. Packet capture shows a custom binary protocol with periodic small keepalives. Which type of malicious activity is most consistent with these findings?
⚠ Common exam trap
The trap here is assuming port 443 always means TLS and benign web traffic, when attackers frequently abuse it for non-TLS command-and-control.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Command-and-control beaconing over a non-standard protocol
The combination of outbound port 443, absence of TLS, a custom binary protocol, and periodic small keepalives strongly suggests command-and-control beaconing. Attackers commonly use port 443 to blend with normal web traffic while evading TLS inspection by not actually using TLS. The regular check-ins are designed to receive instructions or exfiltrate small amounts of data without drawing attention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A misconfigured application using HTTPS on port 443
Why it's wrong here
A misconfigured application would still typically use TLS on port 443, even if the certificate or hostname is wrong. Here the packet capture explicitly shows a custom binary protocol with no TLS, and the periodic keepalives are too regular to be normal application traffic. This pattern is far more indicative of an implant maintaining a channel than of a simple configuration error.
- ✓
Command-and-control beaconing over a non-standard protocol
Why this is correct
Malware often masquerades as HTTPS by using port 443 while speaking a custom binary protocol to evade port-based filtering and TLS inspection. The periodic small keepalives are a hallmark of beaconing, where the implant checks in with its controller at regular intervals. Because the traffic is not actually TLS, signature-based TLS inspection will not flag it, making behavioral analysis essential for detection.
- ✗
Data exfiltration over DNS
Why it's wrong here
DNS exfiltration would generate queries to a resolver, typically on UDP or TCP port 53, with encoded data in subdomains or TXT records. The observed traffic is outbound to port 443 with a custom binary protocol and keepalives, which does not match DNS. While DNS tunneling can hide data, the port and protocol here point to a different mechanism entirely.
- ✗
Lateral movement using SMB
Why it's wrong here
Lateral movement via SMB would involve internal hosts communicating over TCP port 445 with SMB negotiation and authentication traffic. The scenario shows an internal server connecting outbound to an external IP on port 443, which is not consistent with SMB. The custom binary protocol and periodic keepalives further distinguish this from SMB-based movement inside the network.
Go deeper
Related to this question
About these practice questions
One of 968 original 200-201 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.