CHFI OS and Network Forensics Practice Question
During a network forensic investigation, the analyst examines firewall logs and notices a large number of outbound connections from an internal server to various IP addresses on port 443 at regular intervals. The connections are all initiated by a process called 'svchost.exe' running from a non-standard location (C:\Windows\Temp). What is the MOST likely explanation?
⚠ Common exam trap
EC-Council CHFI exam often tests the misconception that svchost.exe is always legitimate, but the key trap here is that the process path (C:\Windows\Temp) is abnormal, and candidates may overlook this detail and incorrectly assume the activity is a normal Windows Update or backup operation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The server is infected with malware that is beaconing to a command-and-control server
Svchost.exe running from C:\Windows\Temp is a classic sign of malware masquerading as a legitimate Windows process. The regular outbound connections on port 443 (HTTPS) at fixed intervals indicate beaconing behavior, where the infected host periodically contacts a command-and-control (C2) server to receive instructions or exfiltrate data. Legitimate svchost.exe resides in C:\Windows\System32, and any deviation from this path is a strong indicator of compromise.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The server is running a scheduled backup to an external cloud service
Why it's wrong here
A scheduled cloud backup agent runs as a dedicated daemon or service executable with a legitimate vendor path such as C:\Program Files\Veeam\..., not as svchost.exe copied into the Temp directory. Backups generate sustained disk and network I/O only during their scheduled backup window and connect to known cloud provider endpoints (e.g., S3 API, Azure Blob storage) over HTTPS, not short, periodic outbound beacons to unfamiliar IPs. The pattern of a known Windows binary name from a user-writable folder with regular outbound connections is far more consistent with binary planting than with backup software.
- ✗
The server is performing legitimate Windows Update checks
Why it's wrong here
Legitimate Windows Update activity runs under the Service Host process loaded from C:\Windows\System32\svchost.exe and uses the Windows Update service (wuauserv) with service-specific DLLs; a copy of svchost.exe residing in the Temp directory violates the integrity of the service host and is never how the update client is loaded. Update checks also resolve to Microsoft-controlled FQDNs and IP ranges such as *.update.microsoft.com or *.windowsupdate.com, whereas the observed traffic is directed to random external IPs. Therefore, the Temp path alone, combined with the non-Microsoft destinations, categorically excludes normal Windows Update checks.
- ✓
The server is infected with malware that is beaconing to a command-and-control server
Why this is correct
The correct indicator set is process-name spoofing combined with network beaconing: the malware uses the legitimate name svchost.exe but executes from the Temp folder, which no built-in Windows service does because the Service Control Manager loads service binaries using the full ImagePath—normally C:\Windows\System32\svchost.exe. The attacker then creates periodic outbound connections at fixed or jittered intervals to a small set of external IPs, typically carrying small, encrypted payloads, to receive commands or exfiltrate data—a classic C2 beacon signature. Defenders observe a single host producing repeatable timing patterns with low data volume per connection, which is nearly pathognomonic for malware.
- ✗
The server is being used as a proxy for internal users
Why it's wrong here
A proxy for internal users would be configured as a dedicated service or application with a clear process name (e.g., Squid, WinGate, or Microsoft ISA/TMG) and would primarily listen for inbound client connections on an advertised port such as 3128 or 8080, not initiate arbitrary outbound connections from a Temp copy of svchost.exe. While the Windows Internet Connection Sharing service does run as svchost.exe, it resides in System32 and forwards traffic on behalf of clients without needing to impersonate a system binary from a user-writable directory. Thus, both the abnormal file location and the outbound-only connection pattern exclude a legitimate forwarding proxy.
Go deeper
Related to this question
About these practice questions
This CHFI question is part of Courseiva's 205-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.