ISC2 CC Security Operations Practice Question
A security analyst is reviewing network flow logs and sees periodic outbound connections from an internal server to an external IP address on TCP port 443 every 30 minutes. The connections transfer small amounts of data and the external IP resolves to a newly registered domain. The server has no business need for internet access. Which type of malicious activity is most consistent with this pattern?
⚠ Common exam trap
The trap here is dismissing encrypted outbound traffic to port 443 as automatically benign, when the timing, destination age, and lack of business need reveal beaconing.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A beaconing implant maintaining command-and-control communication over HTTPS.
Evenly spaced, low-volume outbound sessions to a newly registered external domain on an encrypted port are a textbook beaconing pattern. Malware uses this to check in for instructions while blending with ordinary TLS traffic. Because the server has no legitimate internet requirement, the activity cannot be dismissed as normal business traffic. The right next step is to isolate the host, capture volatile data, and hunt for the implant and its persistence mechanism.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A beaconing implant maintaining command-and-control communication over HTTPS.
Why this is correct
Regular, evenly spaced connections to a newly registered external domain on port 443, with small data transfers, match the profile of malware beaconing to command-and-control infrastructure. The use of HTTPS blends with normal web traffic and evades content inspection. A server with no business internet need makes the pattern even more suspicious, so the host should be isolated and investigated.
- ✗
A denial-of-service attack launched from the server against the external address.
Why it's wrong here
Denial-of-service activity typically involves high-volume traffic intended to exhaust resources, not small periodic exchanges every 30 minutes. The observed pattern is low and slow, which is the opposite of a flood. While the server could be participating in a botnet, the steady beacon-like timing points to command-and-control rather than a volumetric attack.
- ✗
An internal vulnerability scan probing an external host for open ports.
Why it's wrong here
Vulnerability scanners generate bursts of connections across many ports and hosts during scheduled scans, not single small sessions to one external IP every 30 minutes. Scanning activity is also normally initiated from a scanner system, not an arbitrary internal server. The timing and volume here do not match scanning behavior.
- ✗
A misconfigured software update service contacting its vendor repository.
Why it's wrong here
Legitimate update services usually connect to well-known vendor domains with established reputations, and the scenario states the server has no business need for internet access. A newly registered domain paired with rigid 30-minute intervals is not typical of patch infrastructure. This explanation ignores both the domain age and the lack of business justification.
Visual reference
Go deeper
Related to this question
Learn chapter
Business Continuity and Disaster Recovery
Key term
Hypertext Transfer Protocol Secure
Hypertext Transfer Protocol Secure, or HTTPS, is the secure version of HTTP that encrypts data between a web browser and a website using SSL/TLS to protect sensitive information like passwords and credit card numbers.
Key term
Transport Layer Security
Transport Layer Security (TLS) is a cryptographic protocol that provides secure, encrypted communication between two devices over a network, such as between a web browser and a server.
About these practice questions
Courseiva writes every CC question from scratch — 989 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.