mediumMultiple ChoiceObjective-mapped
CISA Practice Question: Refer to the exhibit
Exhibit
Refer to the exhibit. ``` # Audit log extract from firewall 'FW-Primary' 2024-03-15 14:22:33 | rule_id=101 | action=deny | src=10.0.1.50 | dst=172.16.0.1 | port=22 | status=alert 2024-03-15 14:22:34 | rule_id=101 | action=deny | src=10.0.1.50 | dst=172.16.0.1 | port=22 | status=alert 2024-03-15 14:22:35 | rule_id=101 | action=deny | src=10.0.1.50 | dst=172.16.0.1 | port=22 | status=alert 2024-03-15 14:23:01 | rule_id=105 | action=permit | src=10.0.1.50 | dst=172.16.0.5 | port=443 | status=alert 2024-03-15 14:23:02 | rule_id=105 | action=permit | src=10.0.1.50 | dst=172.16.0.5 | port=443 | status=alert ```
Refer to the exhibit. An IS auditor is reviewing firewall logs and notices repeated denied SSH attempts from an internal host (10.0.1.50) to a server (172.16.0.1). After the denied attempts, the host initiates permitted HTTPS connections to another server (172.16.0.5). Which of the following is the BEST interpretation of this pattern?
⚠ Common exam trap
The trap here is that candidates may focus on the reconnaissance aspect (option C) and overlook the deliberate protocol switch, which is the key indicator of an attempt to bypass security controls rather than just map services.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The host may be attempting to bypass security controls by using different protocols
The pattern of denied SSH attempts followed by successful HTTPS connections suggests the internal host is probing for an open SSH service and, when blocked, switches to an allowed protocol (HTTPS) to communicate with a different server. This behavior indicates an attempt to bypass security controls by leveraging a permitted protocol after initial reconnaissance or direct access attempts fail. The firewall logs show the host adapts its method, which is a classic indicator of protocol hopping or tunneling attempts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The host may be attempting to bypass security controls by using different protocols
Why this is correct
The pattern indicates probing blocked service then using permitted service, possibly to evade detection.
- ✗
The firewall rule 101 is misconfigured and blocking legitimate traffic
Why it's wrong here
SSH to that destination may be legitimate to block; no evidence of misconfiguration.
- ✗
The host is performing reconnaissance and has mapped allowed services
Why it's wrong here
The denied attempts show blocked scanning, but the HTTPS is allowed; not necessarily mapping.
- ✗
The host successfully accessed server 172.16.0.1 via SSH
Why it's wrong here
The logs show denied actions, not successful access.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISA question from scratch — 995 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.