N10-009 Network Security Practice Question
A security administrator observes that an employee's workstation is sending large amounts of data to an external IP address on TCP port 443. The workstation is not supposed to initiate outbound connections, and there is no business need for it. What is the most likely cause?
⚠ Common exam trap
It's easy for candidates to assume TCP 443 always indicates legitimate HTTPS traffic, such as a software update or VPN, without considering that attackers commonly use this port to hide malicious C2 communications, especially when the workstation has no business need for outbound connections.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The workstation is part of a botnet and is communicating with a command-and-control server
The workstation is sending large amounts of data to an external IP on TCP port 443, which is commonly used for HTTPS traffic. Since the workstation is not authorized to initiate outbound connections and has no business need for this traffic, the most likely cause is that it has been compromised and is part of a botnet, using HTTPS to communicate with a command-and-control (C2) server to evade detection by blending in with legitimate encrypted web traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The workstation is part of a botnet and is communicating with a command-and-control server
Why this is correct
A botnet infection is highly probable given the workstation's unauthorized outbound transmission of large data volumes to an unknown external IP, without any legitimate business justification. Botnets often leverage common ports like HTTPS (TCP 443) for command-and-control (C2) communication to evade detection, making the traffic appear innocuous. This activity typically involves data exfiltration, participation in DDoS attacks, or receiving further instructions from the botmaster.
- ✗
A legitimate software update is being downloaded
Why it's wrong here
Software updates typically originate from the workstation contacting update servers, but the description says the workstation should not initiate outbound connections. Also, updates usually have a well-known pattern, and the data is 'sent' (upload) rather than downloaded.
- ✗
The workstation is acting as a VPN client connecting to a corporate VPN server
Why it's wrong here
While a VPN client establishes an encrypted tunnel for secure communication, this scenario is unlikely because VPN connections are typically initiated to known, authorized corporate VPN servers for legitimate business purposes. The observed traffic is to an arbitrary external IP address with no business need, which contradicts the controlled and purposeful nature of a corporate VPN connection. Furthermore, VPN traffic is usually expected and accounted for within network policies.
When this WOULD be correct
In a scenario where a workstation is configured to connect to a corporate VPN server for remote access, and the security administrator observes outbound traffic on TCP port 443, this would be the correct answer if the VPN uses HTTPS-based encapsulation.
- ✗
The workstation is hosting a web server that is being accessed externally
Why it's wrong here
A workstation acting as a web server would primarily receive *inbound* connections from external clients requesting content, and then send *outbound* responses. The scenario explicitly states the workstation is *sending* large amounts of data *outbound* as the initial observed anomaly, which is inconsistent with the primary traffic flow of a web server being accessed externally. Additionally, a standard employee workstation is not provisioned to host public web services.
When this WOULD be correct
In a scenario where a security administrator observes a workstation receiving unsolicited inbound traffic on TCP port 443 from external IPs, and the workstation is not supposed to be a server, then the most likely cause would be that the workstation is hosting a web server that is being accessed externally.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓The workstation is part of a botnet and is communicating with a command-and-control serverCorrect answer▾
Why this is correct
A botnet infection is highly probable given the workstation's unauthorized outbound transmission of large data volumes to an unknown external IP, without any legitimate business justification. Botnets often leverage common ports like HTTPS (TCP 443) for command-and-control (C2) communication to evade detection, making the traffic appear innocuous. This activity typically involves data exfiltration, participation in DDoS attacks, or receiving further instructions from the botmaster.
✗The workstation is acting as a VPN client connecting to a corporate VPN serverWrong answer — click to see why▾
Why this is wrong here
The workstation is not supposed to initiate outbound connections, and there is no business need for it, so acting as a VPN client would be an authorized, business-justified activity, not a security concern.
★ When this WOULD be the correct answer
In a scenario where a workstation is configured to connect to a corporate VPN server for remote access, and the security administrator observes outbound traffic on TCP port 443, this would be the correct answer if the VPN uses HTTPS-based encapsulation.
Why candidates choose this
Candidates may confuse outbound HTTPS traffic (port 443) with VPN traffic, especially if they know that some VPNs use port 443 to bypass firewalls, but they overlook the question's context that the workstation should not initiate outbound connections.
✗The workstation is hosting a web server that is being accessed externallyWrong answer — click to see why▾
Why this is wrong here
The workstation is sending data to an external IP on port 443, but hosting a web server would involve inbound connections, not outbound. The question states the workstation initiates outbound connections, which is opposite to a server being accessed externally.
★ When this WOULD be the correct answer
In a scenario where a security administrator observes a workstation receiving unsolicited inbound traffic on TCP port 443 from external IPs, and the workstation is not supposed to be a server, then the most likely cause would be that the workstation is hosting a web server that is being accessed externally.
Why candidates choose this
Candidates may confuse outbound and inbound traffic, or think that port 443 always implies web server activity, without considering the direction of the connection.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Network Access Control (NAC)
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
TCP
TCP (Transmission Control Protocol) is a core internet protocol that ensures data is sent reliably and in order between devices over a network.
About these practice questions
This N10-009 question is part of Courseiva's 464-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.