CHFI Incident Response and First Responder Skills Practice Question

Exhibit

Refer to the exhibit.

C:\Users\Forensic> netstat -ano

Active Connections

  Proto  Local Address          Foreign Address        State           PID
  TCP    192.168.1.10:49152     10.2.3.4:443           ESTABLISHED     1234
  TCP    192.168.1.10:49153     192.168.1.1:80         TIME_WAIT       0
  TCP    192.168.1.10:49154     10.2.3.4:80            ESTABLISHED     1234
  UDP    0.0.0.0:5353           *:*                                    5678

Refer to the exhibit. A first responder runs the netstat command on a compromised Windows workstation. Which of the following conclusions is BEST supported by the output?

⚠ Common exam trap

EC-Council often tests the misconception that TIME_WAIT or UDP listeners are inherently malicious, when in fact they are normal TCP/IP behaviors; the trap here is to recognize that ESTABLISHED connections to unusual ports with a specific PID are the strongest indicator of active C2 communication.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

A process with PID 1234 is likely communicating with a remote C2 server at 10.2.3.4.

An established TCP connection (ESTABLISHED state) from the workstation to a remote IP on a high ephemeral port (49152) with PID 1234 strongly indicates active communication. This is a classic indicator of a beaconing C2 channel, as legitimate outbound connections typically use well-known ports or are short-lived. The netstat output shows PID 1234 has a persistent connection to 10.2.3.4:4444, which is a common port for malware command and control.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The connection to 192.168.1.1:80 is suspicious because it is in TIME_WAIT state.
Why it's wrong here
TIME_WAIT is a standard TCP closure state that occurs after a connection has been gracefully closed; the socket lingers briefly to handle any delayed segments. Seeing a connection to 192.168.1.1:80 in TIME_WAIT simply indicates a completed HTTP exchange, such as a web request, and is not inherently suspicious. Attackers can establish connections that end up in TIME_WAIT too, but the state itself is not a reliable indicator of compromise.
✗
The UDP listener on port 5353 indicates a malware infection.
Why it's wrong here
UDP port 5353 is the default port for multicast DNS (mDNS) and DNS Service Discovery (DNS-SD), commonly used by Bonjour, AirPlay, and many network-aware applications for local device discovery. A listener on this port is typically benign background functionality enabled by default on workstations and does not by itself indicate malware. While some malicious tools could use the same port, the mere presence of a UDP listener without associated anomalous outbound traffic is weak evidence of infection.
✓
A process with PID 1234 is likely communicating with a remote C2 server at 10.2.3.4.
Why this is correct
PID 1234 holding two established TCP connections to the same remote IP address 10.2.3.4 on different ephemeral source ports is a notable pattern. Established connections indicate active communication, and multiple simultaneous connections to a single remote host—especially if that host is not a known internal server—can represent command-and-control (C2) beaconing or data exfiltration, particularly when the process is unfamiliar or unauthorized. This observation warrants further investigation into the process, its binary, and the remote address's reputation.
✗
The workstation is running multiple virtual machines based on the local addresses.
Why it's wrong here
The local address shown for the connections is a single IP address (e.g., 192.168.1.2), which does not suggest the presence of multiple virtual machines. Virtual machines each have their own virtual network interface with distinct IP addresses (or separate loopback adapters), and netstat would list those addresses among the local entries. Moreover, virtual machine traffic is typically bridged or NATed, so the lack of multiple local addresses means this reasoning is unsupported by the exhibit.

Visual reference

Go deeper

CHFI Incident Response and First Responder Skills Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question