hardMultiple ChoiceObjective-mapped
CISM Practice Question: Given the exhibit output from a web server, which…
Exhibit
Refer to the exhibit. ``` # netstat -an | grep :443 tcp4 0 0 *.443 *.* LISTEN tcp4 0 0 192.168.1.100.443 10.0.0.1.54321 ESTABLISHED tcp4 0 0 192.168.1.100.443 10.0.0.2.54322 ESTABLISHED tcp4 0 0 192.168.1.100.443 203.0.113.5.44333 ESTABLISHED ```
Given the exhibit output from a web server, which connection is MOST suspicious and likely indicates a command-and-control (C2) channel?
⚠ Common exam trap
The trap here is that candidates may focus on the high port numbers (54321, 54322) as suspicious, but the key differentiator is the external IP address versus internal RFC 1918 addresses, which is a classic C2 indicator.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Connection to 203.0.113.5:44333
Connection to 203.0.113.5:44333 is the most suspicious because it uses a non-standard high port (44333) to an external IP address, which is a common technique for C2 traffic to evade detection by blending with HTTPS-like traffic. Legitimate web servers typically connect to well-known ports (e.g., 80, 443) or internal services, not arbitrary external high ports. The exhibit likely shows a netstat output where this outbound connection to an external IP on an unusual port stands out as anomalous.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Connection to 10.0.0.1:54321
Why it's wrong here
Internal IP, likely legitimate.
- ✗
The listening socket on port 443
Why it's wrong here
Listening socket is normal for a web server.
- ✓
Connection to 203.0.113.5:44333
Why this is correct
External IP with non-standard high port, common for C2.
- ✗
Connection to 10.0.0.2:54322
Why it's wrong here
Also internal IP.
Go deeper
Related to this question
About these practice questions
This CISM question is part of Courseiva's 871-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.