CHFI Network and Cloud Forensics Practice Question
Exhibit
Refer to the exhibit. ``` C:\>netstat -ano Active Connections Proto Local Address Foreign Address State PID TCP 0.0.0.0:3389 0.0.0.0:0 LISTENING 1234 TCP 192.168.1.10:49152 203.0.113.5:443 ESTABLISHED 5678 TCP 192.168.1.10:49153 192.168.1.1:53 TIME_WAIT 0 UDP 0.0.0.0:5353 *:* 910 UDP 192.168.1.10:137 *:* 910 ```
During a forensic investigation, the analyst runs netstat -ano on a compromised workstation. Based on the exhibit, which connection is MOST suspicious and should be investigated further?
⚠ Common exam trap
EC-Council often tests the misconception that any listening service (like RDP or mDNS) is inherently suspicious, when in fact established external connections to unknown IPs are far more indicative of active compromise.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The established HTTPS connection to 203.0.113.5:443 (PID 5678).
The established HTTPS connection to 203.0.113.5:443 (PID 5678) is most suspicious because it is an external IP address (not in the private RFC 1918 range) with an established TCP connection, indicating active data transfer. In a forensic context, an outbound HTTPS connection to an unknown external IP is a common indicator of command-and-control (C2) communication or data exfiltration, especially when the PID can be traced to an unknown or malicious process.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The established HTTPS connection to 203.0.113.5:443 (PID 5678).
Why this is correct
An established HTTPS connection to 203.0.113.5:443 is the clearest anomaly because 203.0.113.0/24 is TEST-NET-3, a documentation-only range that real internet services never legitimately use. An outbound connection to that test address over the standard TLS port strongly suggests C2 traffic, data exfiltration, or a covert tunnel masquerading as HTTPS. PID 5678 enables triage to the responsible process, but the destination alone warrants immediate isolation and memory capture.
- ✗
The DNS query to 192.168.1.1:53 in TIME_WAIT state.
Why it's wrong here
A DNS query to 192.168.1.1:53 is routine internal infrastructure traffic, not an IOC: 192.168.1.1 is the typical default gateway and recursive resolver in SOHO networks. TIME_WAIT is a TCP state that only appears after a closed connection, and it simply indicates the client completed an exchange; DNS normally uses UDP, but a TCP fallback for large responses or zone transfers is legitimate. There is no external destination, no unusual port, and no encrypted channel that would hide malicious payloads.
- ✗
The UDP listener on port 5353 (mDNS) with PID 910.
Why it's wrong here
mDNS (port 5353/UDP) serves zero-configuration hostname resolution on the local link, using multicast address 224.0.0.251, so a device with PID 910 advertising or browsing services through it is normal consumer/enterprise behavior. It is a passive listening socket, not a connection to a remote host, and its multicast nature means traffic never leaves the local segment. Unless a rogue process is bound to all interfaces or paired with another IOC, it does not represent a compromise.
- ✗
The listening RDP service on port 3389 (PID 1234).
Why it's wrong here
An RDP service listening on 3389 is a default configuration for Windows servers and VDI hosts; in itself it is neither evidence of intrusion nor of lateral movement. The socket is in LISTEN state, meaning no remote session is active, and PID 1234 can be checked against the trusted services (e.g., termsrv.dll in svchost). While exposing RDP to the internet is risky and would warrant a risk note, in this netstat snapshot it is not the suspicious indicator.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every CHFI question from scratch — 205 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.