CS0-003 Security Operations Practice Question
During a network traffic analysis, a security analyst observes repeated connections from an internal host to a known malicious IP on port 4444. The payload appears to be encrypted. Which type of activity is most likely indicated?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Command and control beaconing
Repeated connections to a known malicious IP on a non-standard port with encrypted payloads strongly suggest command and control (C2) beaconing.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Port scanning activity
Why it's wrong here
Port scanning typically involves probing multiple ports on a single host or a single port across multiple hosts to discover open services and vulnerabilities. The scenario describes repeated connections to one specific IP on one specific port (4444), which is not characteristic of a broad port scan aimed at discovery. Instead, this pattern suggests a targeted, established communication channel rather than an exploratory scan.
- ✓
Command and control beaconing
Why this is correct
Command and control (C2) beaconing involves an infected host periodically initiating outbound connections to a C2 server, often on a non-standard port like 4444, to check for new commands or upload data. These connections are typically regular, repetitive, and consistent in their destination and port, fitting the description of repeated connections to a single IP on port 4444. This behavior establishes a persistent communication channel for remote control of the compromised system.
- ✗
Data exfiltration via DNS tunnelling
Why it's wrong here
DNS tunneling encapsulates data within DNS queries and responses, leveraging the DNS protocol (typically UDP port 53) to bypass firewalls and exfiltrate information. The observed activity, however, involves direct TCP/UDP connections on port 4444, which is entirely distinct from the mechanism and port utilized by DNS tunneling for data exfiltration. Therefore, this option does not align with the described network traffic characteristics.
- ✗
Lateral movement using SMB
Why it's wrong here
Lateral movement involves an attacker moving from one compromised system to another within a network, often leveraging protocols like Server Message Block (SMB) on port 445, Remote Desktop Protocol (RDP) on port 3389, or SSH on port 22. The scenario describes repeated connections to a single IP on port 4444, which is not indicative of the multi-host, internal network traversal characteristic of lateral movement, nor does it use the typical SMB port.
Go deeper
Related to this question
Learn chapter
SIEM Log Analysis
Key term
Analysis
In incident response, analysis is the process of examining data and events to determine what happened, how it happened, and what actions to take.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
One of 236 original CS0-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.