CEH Practice Question: Malware, Social Engineering and Network Attacks
A network administrator notices an unusual amount of traffic on port 389 from an internal server to multiple external IP addresses. Which type of malware might be present?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Trojan backdoor
Port 389 is used by LDAP. Outbound traffic to multiple external IPs could indicate LDAP query-based command and control or data exfiltration, but more commonly, port 389 is associated with directory services. However, in malware context, it could be a sign of a backdoor or RAT using LDAP for C2. The most likely is that the malware is using LDAP for communication, but given options, a Trojan backdoor is plausible.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Adware
Why it's wrong here
Adware primarily focuses on displaying unwanted advertisements, often through web browser pop-ups or injected content. While it does generate network traffic, this is typically HTTP/HTTPS for fetching ads or reporting user activity, and it's generally not characterized by "unusual amounts of traffic" in the sense of covert data exfiltration or sustained command and control (C2) channels that would significantly impact network performance or raise immediate red flags beyond typical browsing patterns. Its primary goal is revenue through ad impressions, not stealthy, high-volume data transfer.
- ✗
Worm
Why it's wrong here
A worm's defining characteristic is its self-replicating nature, actively scanning networks for vulnerable systems to infect. This propagation often involves exploiting known service vulnerabilities (e.g., SMB, RDP) on standard or non-standard ports, or attempting connections on a wide range of random ports to find open services. While worms can generate significant network traffic due to their scanning and replication attempts, this traffic pattern is usually distinct, characterized by numerous connection attempts to various IP addresses and ports, rather than a sustained, covert communication channel often associated with a backdoor.
- ✓
Trojan backdoor
Why this is correct
A Trojan backdoor establishes a hidden communication channel, allowing an attacker remote access and control over a compromised system. This type of malware is designed for persistence and stealth, often using less common or seemingly legitimate protocols like LDAP (Lightweight Directory Access Protocol) or DNS for command and control (C2) or data exfiltration. The "unusual amount of traffic" could stem from the attacker issuing commands, transferring files, or exfiltrating data through this covert channel, making it a strong candidate for a sustained, anomalous traffic pattern.
- ✗
Ransomware
Why it's wrong here
Ransomware's primary objective is to encrypt a victim's data and demand a ransom for its decryption. While it does communicate with command and control (C2) servers, typically over HTTP/HTTPS, this traffic is usually limited to initial key exchange, reporting infection status, and potentially receiving decryption keys. The "unusual amount of traffic" described in the question is less characteristic of ransomware's core operational phase, which focuses on local file encryption, and more indicative of sustained data exfiltration or active remote control, which are not its primary functions.
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.