CHFI OS and Network Forensics Practice Question
A security analyst is reviewing firewall logs and notices repeated connection attempts from an internal IP to an external server on TCP port 4444. The internal host is a web server. What is the MOST likely explanation?
⚠ Common exam trap
The key trap here is that candidates see 'connection attempts' and assume it is an inbound scan (Option C), but the question specifies the internal IP is the source, meaning the web server is initiating the connection, which is the hallmark of a reverse shell or C2 beacon. In CHFI, understanding traffic direction and common C2 port usage is critical.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The web server has a reverse shell connection to a command-and-control server
Repeated outbound connections from an internal web server to an external server on TCP port 4444 strongly indicate a reverse shell, which is a common technique used by malware to establish command-and-control (C2) communication. Unlike a standard client-server model, the internal host initiates the connection to bypass firewalls that block inbound traffic, and port 4444 is frequently associated with Metasploit's default reverse shell payload (e.g., meterpreter). This behavior is anomalous for a web server, which typically serves HTTP/HTTPS on ports 80/443 and does not initiate persistent outbound connections to arbitrary external IPs on non-standard ports.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The web server is serving HTTPS traffic on port 4444
Why it's wrong here
HTTPS normally operates over TCP port 443, and a web server serving HTTPS on port 4444 would attract inbound connections from clients to that port, not generate outbound connections from the server to one fixed external IP. In this log, the traffic direction is outbound from the server toward a single destination, which is the opposite of normal web serving. Furthermore, port 4444 is a well-known default for Metasploit reverse shells, making this pattern far more consistent with a callback than with custom HTTPS.
- ✗
The web server is performing DNS queries
Why it's wrong here
DNS queries typically use UDP port 53, and even when TCP port 53 is used for zone transfers or large responses, the destination would be a DNS resolver or authoritative name server, not an arbitrary external IP on TCP 4444. Additionally, DNS traffic consists of short, intermittent queries, whereas this log shows repeated connections to the same external IP on a non-standard high port, which is not the behavior of a server performing name resolution. The direction, port, and destination pattern all rule out DNS activity.
- ✗
The web server is being scanned for open ports
Why it's wrong here
A port scan is an inbound reconnaissance technique where an external scanner sends probes to many different ports on the target host to discover open services. The log described here shows the web server itself making repeated outbound connections to a single external IP on a specific port, which has the opposite source-destination relationship of a scan. Scanning would produce a burst of connection attempts across multiple ports with no sustained session, not ongoing communication with one command-and-control address.
- ✓
The web server has a reverse shell connection to a command-and-control server
Why this is correct
An outbound TCP connection from a compromised web server to a single external IP on a non-standard high port such as 4444 is a classic reverse-shell indicator. Because the server initiates the connection, it can evade typical inbound firewall restrictions, allowing an attacker to receive a shell session through a listener on the command-and-control host. The repeated nature of the connections suggests beaconing for instructions, a hallmark of C2 communication.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 205 original CHFI practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.