CHFI Mobile and Malware Forensics Practice Question

An incident responder receives an alert that a workstation is beaconing to a known malicious IP address. The responder captures network traffic and analyzes it with Wireshark. Which of the following would be an immediate indicator of compromise (IoC) visible in the traffic capture?

⚠ Common exam trap

The CHFI exam often tests the distinction between a direct IoC (like beaconing to a known malicious IP) and secondary indicators (like large file transfers or ARP anomalies) that require additional context to confirm compromise.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Repeated connections to a known malicious IP address on a non-standard port

Repeated connections to a known malicious IP address on a non-standard port directly match the definition of a beaconing indicator of compromise (IoC). In network traffic analysis, beaconing is characterized by periodic, outbound connections to a command-and-control (C2) server, often using a non-standard port to evade detection. This pattern is a primary IoC in malware forensics and is immediately visible in Wireshark as a series of TCP SYN packets to the same IP and port at regular intervals.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Large file transfers during off-hours
Why it's wrong here
Large file transfers during off-hours can be a symptom of data exfiltration, but size and timing alone are not sufficient to establish malice. A backup job, a user syncing a local repository, or a scheduled database export can produce identical traffic patterns. Unless the transfer also matches a known-malicious destination or an anomalous protocol/behavior profile, it remains a low-fidelity indicator that requires additional context.
✗
ARP requests from unknown MAC addresses
Why it's wrong here
ARP requests from unknown MAC addresses are a routine part of network discovery, especially on segmented or high-churn networks. A new device, a printer lease renewal, or a network card replacement can generate such requests without implying compromise. However, an ARP spoofing attack would involve a flood of responses, not merely requests, and the MAC itself would need to be tied to a spoofing attempt or malicious activity to be meaningful. Thus, the presence of an unknown source in ARP traffic is not an indicator of compromise by itself.
✗
Encrypted payloads using TLS 1.3
Why it's wrong here
Encrypted payloads using TLS 1.3 are the expected baseline for legitimate modern web, email, and API traffic—so encryption alone cannot be an IoC. TLS 1.3 specifically strengthens privacy, which means defenders must rely on endpoint context, certificate metadata, and connection destinations rather than the ciphertext. To flag this as malicious, you would need evidence like a certificate mismatch, a reputation check on the server, or process-level anomalies, none of which is implied by merely seeing TLS 1.3.
✓
Repeated connections to a known malicious IP address on a non-standard port
Why this is correct
Repeated connections to a known malicious IP address on a non-standard port is a high-fidelity indicator of compromise because it combines an established threat reputation with observable behavior that matches command-and-control (C2) beaconing. Non-standard ports are often used by malware to evade simple port-based filters, and the recurrence suggests a persistent callback rather than an accidental or one-time connection. This pattern directly aligns with the MITRE ATT&CK technique T1071 for application-layer C2 traffic.

Visual reference

Go deeper

CHFI Mobile and Malware Forensics Practice Question

Why each option matters

Option-by-option breakdown

Related to this question