Reverse Shell Detection via Outbound Traffic
A security analyst notices unusual outbound traffic from an internal server to a known malicious IP address on port 4444. The server is running a web application that was recently scanned using a vulnerability scanner. Which of the following is the MOST likely cause?
Quick Answer
The correct answer is that a vulnerability discovered during the scan was exploited, establishing a reverse shell connection to the attacker. This is the most likely cause because outbound traffic on port 4444 from an internal server to a known malicious IP is a textbook indicator of reverse shell detection outbound traffic, where the compromised system initiates the connection back to the attacker’s listener to bypass inbound firewall restrictions. On the Certified Ethical Hacker CEH exam, this scenario tests your ability to correlate post-scan activity with common post-exploitation techniques, specifically distinguishing a reverse shell from a simple data exfiltration or beaconing. A common trap is assuming all outbound traffic is data theft, but the key clue is the high port (4444) and the timing immediately after a vulnerability scan, which points to an exploited remote code execution flaw. Memory tip: think “reverse the flow” — the victim calls out, so the firewall lets it through, and 4444 is a classic Metasploit default.
⚠ Common exam trap
Many candidates confuse reverse shells with normal outbound traffic like DNS or backups, failing to recognize that port 4444 is a well-known Metasploit default for reverse TCP payloads and that outbound connections to malicious IPs are a hallmark of compromise.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A vulnerability discovered during the scan was exploited, establishing a reverse shell connection to the attacker
Outbound traffic on port 4444 from an internal server to a known malicious IP is a classic indicator of a reverse shell connection. A reverse shell is a common post-exploitation technique where an attacker forces the victim server to connect back to their listener, often on high ports like 4444, bypassing inbound firewall rules. The timing after a vulnerability scan strongly suggests that a discovered vulnerability (e.g., command injection, RCE) was exploited to establish this shell.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The server is performing a DNS lookup to resolve the malicious IP address
Why it's wrong here
DNS lookups use UDP or TCP port 53 to a resolver, never port 4444 to a known malicious IP. It tempts because resolving an address precedes connection, but the observed traffic is an established outbound session on port 4444, indicating command-and-control rather than name resolution.
- ✗
The web application is sending log data to a SIEM system for analysis
Why it's wrong here
SIEM log forwarding uses syslog port 514 or TLS 6514 to an internal collector, not port 4444 to a known malicious IP. It tempts because web applications do ship logs, but the destination address and port 4444 point to a reverse shell, not legitimate monitoring infrastructure.
- ✓
A vulnerability discovered during the scan was exploited, establishing a reverse shell connection to the attacker
Why this is correct
Port 4444 is Metasploit's default reverse shell listener, and outbound traffic to a malicious IP indicates the exploited host initiated the connection. The recent vulnerability scan likely identified the flaw the attacker then leveraged, satisfying the stem's requirement for the most likely cause of this beaconing behaviour.
- ✗
The vulnerability scan caused a false positive and triggered a legitimate backup process
Why it's wrong here
A vulnerability scan cannot create a false positive that spawns a legitimate backup process to a malicious IP on port 4444; backups use defined destinations and ports. It tempts as scan noise is common, but the malicious IP and port 4444 indicate a reverse shell from exploited web-app code.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 913 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CEH
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security analyst observes unusual outbound traffic from an internal host to an external IP on port 443. The analyst suspects a reverse shell where the internal host initiates an HTTPS connection to the attacker. Which Nmap script would be MOST useful to confirm the nature of this traffic if the analyst can run a scan on the internal host?
hard- ✓ A.tls-nextprotoneg
- B.smb-enum-shares
- C.http-malware-host
- D.ssh2-enum-algos
Why A: tls-nextprotoneg is correct because it detects the TLS Next Protocol Negotiation (NPN) extension. Reverse shells often use NPN/ALPN to establish non-standard application-layer protocols over HTTPS to evade detection. If the analyst runs Nmap *from* the internal host *targeting the external IP*, this script can probe the external server to reveal if the TLS session it offers is attempting to negotiate a protocol other than standard HTTP, which would indicate a reverse shell command and control (C2) server.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.