CEH Practice Question: Malware, Social Engineering and Network Attacks
A security analyst observes a gradual increase in network traffic from an internal host to an external IP address on port 443, with the host also connecting to a known command-and-control (C2) domain. Which type of malware is MOST likely responsible?
⚠ Common exam trap
The trap here is that candidates may associate port 443 with legitimate web traffic and overlook the gradual, stealthy nature of the C2 communication, instead choosing ransomware or worm due to their more dramatic behaviors.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Backdoor Trojan
The gradual increase in traffic to an external IP on port 443 (HTTPS) combined with connections to a known C2 domain indicates a backdoor Trojan. Backdoor Trojans establish stealthy, encrypted command-and-control channels to exfiltrate data or receive instructions, often mimicking legitimate HTTPS traffic to evade detection. This behavior aligns with a backdoor Trojan's purpose of providing unauthorized remote access while blending into normal network activity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Ransomware
Why it's wrong here
Ransomware's primary function is data encryption and extortion, leading to distinct network traffic patterns such as initial key exchange, potential data exfiltration, and communication for payment instructions. While some variants may use C2 for initial deployment or exfiltration, the characteristic 'gradual increase' in network traffic is less typical for its core operational phase, which often involves bursty activity rather than sustained, low-volume C2.
- ✗
Worm
Why it's wrong here
Worms are self-propagating malware designed to spread autonomously across networks by exploiting vulnerabilities. Their network footprint is primarily characterized by widespread scanning activity and attempts to infect new hosts, generating significant, often erratic, traffic spikes rather than a consistent, gradual increase from a single compromised machine. While some worms might incorporate C2 capabilities, their defining network behavior is typically focused on rapid dissemination, not persistent, subtle communication.
- ✗
Boot sector virus
Why it's wrong here
A boot sector virus infects the Master Boot Record (MBR) or Volume Boot Record (VBR) of storage devices, executing before the operating system loads. Its operational scope is primarily localized to the system's startup process and file system integrity, with minimal to no inherent network communication capabilities. Therefore, observing a gradual increase in network traffic from a compromised host is not a typical symptom of a boot sector virus, as its functionality does not involve remote command and control.
- ✓
Backdoor Trojan
Why this is correct
A backdoor Trojan establishes a covert communication channel, granting an attacker persistent remote access and control over the compromised system. This persistent access necessitates regular, often low-volume, communication with a Command and Control (C2) server to receive commands, exfiltrate data, or update its status. The observed 'gradual increase in network traffic' is highly indicative of such C2 activity, as the attacker intermittently interacts with the backdoor over time, leading to a subtle but sustained rise in outbound or inbound connections.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.