mediumMultiple ChoiceObjective-mapped
CISM Practice Question: A security analyst detects unusual outbound…
A security analyst detects unusual outbound network traffic from a database server to an unknown IP address. The traffic uses encrypted connections on port 443. Which type of attack is MOST likely occurring?
⚠ Common exam trap
A common mix-up: candidates confuse the encrypted traffic on port 443 with legitimate database replication or backup traffic, but the unknown destination IP and unusual outbound pattern from a database server are key red flags for exfiltration, not a normal administrative function.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Data exfiltration
The encrypted outbound traffic on port 443 (HTTPS) from a database server to an unknown IP is a classic indicator of data exfiltration. Attackers often use encrypted channels to bypass network security controls, as the contents of the traffic cannot be inspected by DLP or IDS/IPS systems. The database server is a high-value target for sensitive data, making this the most likely attack scenario.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Data exfiltration
Why this is correct
Encrypted outbound traffic to an unknown IP is a classic sign of data exfiltration.
- ✗
SQL injection
Why it's wrong here
SQL injection is typically used to extract data via web application, not encrypted outbound traffic.
- ✗
Ransomware
Why it's wrong here
Ransomware usually encrypts files locally and demands ransom, not necessarily exfiltrating data.
- ✗
Denial of service
Why it's wrong here
DoS attacks generate high traffic to overwhelm resources, not stealthy encrypted outbound.
Go deeper
Related to this question
About these practice questions
One of 871 original CISM practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.