easyMultiple ChoiceObjective-mapped
CS0-003 Practice Question: Refer to the exhibit
Exhibit
Active Internet connections (servers and established) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN tcp 0 0 10.0.0.5:54321 198.51.100.20:443 ESTABLISHED tcp 0 0 192.168.1.10:80 0.0.0.0:* LISTEN udp 0 0 0.0.0.0:53 0.0.0.0:*
Refer to the exhibit. The output is from a Linux system running `netstat -an`. Which of the following ports is likely being used for remote command-and-control communication?
⚠ Common exam trap
CompTIA often tests the concept that high-numbered ephemeral ports (above 1024) with no associated standard service are strong indicators of C2 activity, tricking candidates into choosing common service ports like 22, 53, or 80 because they are familiar, even though those are legitimate and monitored.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
54321
Port 54321 is a high-numbered ephemeral port that is not associated with any standard service, making it a common choice for malware or remote access tools (RATs) to establish command-and-control (C2) communication. In the netstat -an output, an established connection on a non-standard high port from the local system to a remote IP is a strong indicator of C2 activity, as legitimate services typically use well-known ports.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
54321
Why this is correct
Port 54321 falls into the dynamic/private port range, typically used for ephemeral client-side connections. However, if observed as a listening port or as the destination port for an established connection to an external IP, it becomes highly anomalous. Attackers frequently utilize high, non-standard ports for command and control (C2) communication or data exfiltration to bypass basic firewall rules and blend with legitimate outbound traffic, making it a strong indicator of compromise.
- ✗
22
Why it's wrong here
Port 22 is the standard port for Secure Shell (SSH), a cryptographic network protocol used for secure remote access and file transfers. While SSH can be a target for brute-force attacks or used maliciously if compromised, its presence as an established connection is generally expected for legitimate system administration. Without further context indicating unauthorized access or unusual traffic patterns, SSH itself is not inherently anomalous.
- ✗
53
Why it's wrong here
Port 53 is dedicated to the Domain Name System (DNS), a critical service for translating human-readable domain names into IP addresses. Both UDP and TCP port 53 are fundamental for nearly all internet communication, making its presence in network traffic entirely expected. Although DNS can be exploited for tunneling or data exfiltration, the mere observation of traffic on port 53 does not, by itself, indicate an anomaly or compromise.
- ✗
80
Why it's wrong here
Port 80 is the well-known port for the Hypertext Transfer Protocol (HTTP), which is the foundation of data communication for the World Wide Web. Web browsers and servers routinely communicate over this port for unencrypted web traffic. Therefore, seeing established connections on port 80 is a common and legitimate occurrence in almost any network environment, reflecting normal user activity or server functions.
Go deeper
Related to this question
About these practice questions
One of 236 original CS0-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.