hardMultiple ChoiceObjective-mapped
CRISC Practice Question: Based on the firewall log exhibit, which of the…
Exhibit
Refer to the exhibit. Exhibit (Firewall Log): ``` 2024-02-10 08:23:45 DENY TCP 10.0.1.15 3389 203.0.113.50 443 2024-02-10 08:23:46 DENY TCP 10.0.1.15 3389 203.0.113.50 443 2024-02-10 08:23:47 DENY TCP 10.0.1.15 3389 203.0.113.50 443 2024-02-10 08:23:48 ALLOW TCP 10.0.1.10 443 198.51.100.20 3389 ```
Based on the firewall log exhibit, which of the following conclusions is MOST appropriate for risk identification?
⚠ Common exam trap
The trap here is that candidates focus on the source/destination IPs and assume any outbound connection is benign, overlooking the significance of the destination port (4444) as a common reverse shell indicator, which ISACA often uses to test understanding of outbound threat patterns versus simple inbound attack detection.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
There is evidence of a potential reverse shell or malware beaconing from host 10.0.1.15
The firewall log shows an outbound connection from internal host 10.0.1.15 to external server 203.0.113.50 on a high ephemeral port (e.g., 4444), which is commonly associated with reverse shell payloads or malware command-and-control (C2) beaconing. This pattern indicates that the internal host may have been compromised and is establishing an outbound channel to an external attacker, bypassing typical inbound firewall rules. Such behavior is a critical risk indicator for IT risk identification, as it suggests active malicious activity within the network.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
External server 198.51.100.20 is attempting to exploit host 10.0.1.10
Why it's wrong here
The ALLOW entry is from internal to external, not external to internal.
- ✗
Host 10.0.1.15 is successfully communicating with external server 203.0.113.50
Why it's wrong here
All attempts were denied, so no successful communication.
- ✗
The firewall is functioning correctly with no security incidents
Why it's wrong here
Denied outbound attempts are suspicious and indicate potential incident.
- ✓
There is evidence of a potential reverse shell or malware beaconing from host 10.0.1.15
Why this is correct
Denied outbound traffic from internal host to external IP on common malware ports indicates possible compromise.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CRISC question from scratch — 983 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.