CEH Practice Question: Malware, Social Engineering and Network Attacks
A security analyst notices a significant increase in outbound traffic from an internal server to multiple external IPs on port 443. The server is not a web server and should not be initiating such connections. Which type of malware is MOST likely causing this behavior?
⚠ Common exam trap
Many exam-takers confuse a worm's network propagation behavior with a backdoor Trojan's command-and-control traffic, but the key differentiator is that the server is not a web server and the connections are outbound to multiple external IPs on a common encrypted port, which is classic C2 exfiltration, not self-replication.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A backdoor Trojan
A backdoor Trojan is designed to give an attacker remote control over an infected system, often using outbound connections on common ports like 443 (HTTPS) to blend in with normal traffic. Since the server is not a web server and should not be initiating outbound HTTPS connections, this anomalous behavior strongly indicates a backdoor Trojan is exfiltrating data or receiving commands via encrypted channels.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A boot sector virus
Why it's wrong here
A boot sector virus primarily targets the Master Boot Record (MBR) or Volume Boot Record (VBR) to gain control during system startup. Its infection mechanism focuses on disk-level persistence and execution before the operating system fully loads. While it can potentially load other malware, a boot sector virus itself does not inherently generate significant outbound HTTPS network traffic to numerous IP addresses, as its core functionality is not network-dependent.
- ✓
A backdoor Trojan
Why this is correct
A backdoor Trojan is designed to provide covert remote access to a compromised system, often establishing persistent communication channels with Command and Control (C2) servers. This communication frequently occurs over encrypted protocols like HTTPS to evade detection and blend with legitimate network traffic. The observed significant increase in outbound HTTPS traffic to multiple IP addresses is highly characteristic of a backdoor Trojan actively exfiltrating data, receiving commands, or updating its C2 infrastructure.
- ✗
A fileless virus
Why it's wrong here
A fileless virus operates by residing solely in memory, leveraging legitimate system tools and processes to execute without writing malicious files to disk. While fileless techniques are often employed by various malware types, including those that communicate with C2 servers, the "fileless" characteristic itself describes its execution and persistence method, not its inherent network communication behavior. Therefore, the observed outbound HTTPS traffic is not directly explained by its fileless nature, but rather by the payload it might deliver.
- ✗
A worm
Why it's wrong here
A worm is designed for self-propagation across networks, typically by exploiting vulnerabilities in unpatched systems or through social engineering. While worms generate significant network traffic, this traffic usually consists of scanning attempts on various ports and protocols to identify new targets, rather than sustained outbound HTTPS connections to numerous distinct IP addresses. The observed pattern is less indicative of a worm's primary propagation mechanism and more aligned with C2 communication.
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.