SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
A firewall analyst reviews logs and sees one external IP address sending connection attempts to TCP ports 22, 80, 139, 445, and 3389 on dozens of internal hosts every few seconds. No payloads are delivered and no sessions are established. What is the most likely activity?
⚠ Common exam trap
Watch out — candidates often confuse a port scan with a denial-of-service attack because of the high frequency of connection attempts, but the key distinction is that no sessions are established and no payloads are delivered, which rules out DoS and exploitation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Port scanning, because the source is systematically probing many ports and hosts for exposed services.
The observed behavior—a single external IP sending connection attempts to multiple TCP ports (22, 80, 139, 445, 3389) across many internal hosts at regular intervals—is the hallmark of a port scan. The absence of payload delivery or session establishment confirms the attacker is only probing for open services, not attempting exploitation or data transfer. This matches the definition of a reconnaissance activity, specifically a horizontal port scan targeting common service ports.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Port scanning, because the source is systematically probing many ports and hosts for exposed services.
Why this is correct
This is a classic port-scanning pattern. The source IP is sending a high volume of connection attempts (often SYN packets) to multiple destination ports across many internal hosts in a short window, without completing the TCP handshake. This behavior is consistent with automated reconnaissance tools like Nmap, which systematically probe for open services to identify attack surface before exploitation. The lack of established sessions and the breadth of targets make any other conclusion improbable.
- ✗
Reflection-based denial-of-service, because the attacker is using third-party systems to amplify traffic.
Why it's wrong here
Reflection-based denial-of-service (DoS) relies on the attacker spoofing the victim's IP address and sending requests to public amplifiers (e.g., open DNS resolvers or NTP servers), which then flood the victim with responses. The firewall logs would show a massive inbound volume of UDP traffic from many unrelated third-party IPs, not a single external IP making outbound connection attempts. Here, the source is directly probing internal hosts, and there is no spoofing or amplification intermediary involved, so this option does not match the evidence.
- ✗
Man-in-the-middle, because the attacker is intercepting communications between internal hosts.
Why it's wrong here
A man-in-the-middle (MITM) attack requires the attacker to position themselves between two communicating parties to intercept, decrypt, or alter traffic in transit. This is usually achieved through ARP spoofing, DNS poisoning, or rogue gateways, and it affects established sessions. The firewall logs show one external IP sending unsolicited connection attempts to many internal hosts, not intercepted or forwarded traffic between internal endpoints. There is no evidence of session hijacking, traffic redirection, or altered communications, so this is incorrect.
- ✗
Protocol abuse, because the attacker is sending malformed traffic to crash services.
Why it's wrong here
Protocol abuse, in the context this option implies, involves exploiting weaknesses in network protocols by sending malformed, oversized, or out-of-state packets to crash a service or bypass security controls. The logs do not show packet anomalies, protocol violations, or service crashes; they show normal TCP/UDP connection attempts to many ports and hosts. A single external IP performing systematic port sweeps is the signature of reconnaissance, not a targeted protocol exploit. If malformed traffic were present, the logs would indicate flags, fragmentation, or size anomalies, which are absent here.
Visual reference
Go deeper
Related to this question
Learn chapter
Session Hijacking and Fixation
Key term
Firewall
A firewall is a network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules to protect trusted internal networks from untrusted external networks.
Key term
TCP
TCP (Transmission Control Protocol) is a core internet protocol that ensures data is sent reliably and in order between devices over a network.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.