220-1102 Security Practice Question
A security analyst is reviewing logs from a user's workstation that show regular outbound connections to a known malicious IP address on port 443. Antivirus scans on the workstation report no threats. Which type of malware is most likely present?
⚠ Common exam trap
Many exam-takers assume any malware that evades antivirus must be a rootkit, but the key clue is the regular outbound connections on port 443, which is classic Trojan C2 behavior, not rootkit stealth functionality.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Trojan
A Trojan is the most likely malware because it can masquerade as a legitimate file to evade antivirus detection while establishing outbound connections to a command-and-control (C2) server on port 443 (HTTPS). The use of port 443 allows the traffic to blend in with normal encrypted web traffic, making it harder for network monitoring tools to flag the activity. The absence of antivirus alerts does not rule out a Trojan, as modern Trojans often use obfuscation, packing, or fileless techniques to avoid signature-based detection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Worm
Why it's wrong here
Worms self-replicate and spread automatically across networks, often exploiting unpatched services or using phishing attachments. The key distinguishing factor is propagation: a worm's primary behavior is lateral movement and replication, not maintaining a steady, low-and-slow C2 heartbeat. A clean antivirus and regular outbound connections to a single IP point more to a discreet backdoor than to a worm's noisy, scanning-driven activity.
- ✗
Ransomware
Why it's wrong here
Ransomware is typically an attack of immediate impact: it encrypts user files and displays a ransom demand. While some ransomware families do exfiltrate data before encryption, they don't usually keep a persistent, long-lived outbound connection to a C2 server after the payload has been delivered; the encryption and ransom note would be obvious to the user, which is inconsistent with a quiet, ongoing C2 dialogue.
- ✗
Rootkit
Why it's wrong here
A rootkit is specifically designed to hide its own presence and often the attacker's artifacts from the operating system and security tools, but its function is stealth and persistence via privilege escalation/kernel hooks. The symptom here is regular outbound network connections to a malicious IP; while a rootkit could enable that, the term that best describes a program that appears benign but provides covert remote access and C2 is "Trojan." The rootkit is a technique, not the initial infection vector.
- ✓
Trojan
Why this is correct
A Trojan horse is a malicious program disguised as a legitimate file or application, and one of its most common payloads is a backdoor that silently connects to a command-and-control server. Regular outbound connections to a known-bad IP, combined with a clean antivirus scan, fit the classic signature of a backdoor Trojan that has established persistent C2 and is patiently awaiting commands. The user's logs show the Trojan's beaconing behavior, which is distinct from the self-propagating, encrypting, or rootkit-hiding behaviors of the other malware types.
Go deeper
Related to this question
Learn chapter
Malware Classification: Virus, Worm, Ransomware, Rootkit
Key term
Hypertext Transfer Protocol Secure
Hypertext Transfer Protocol Secure, or HTTPS, is the secure version of HTTP that encrypts data between a web browser and a website using SSL/TLS to protect sensitive information like passwords and credit card numbers.
Key term
Malware
Malware is any software intentionally designed to cause damage, disrupt operations, steal data, or gain unauthorized access to computer systems.
About these practice questions
This 220-1102 question is part of Courseiva's 925-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1102 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1102 exam.