ISC2 CC Business Continuity, DR & Incident Response Practice Question
Exhibit
[2025-03-05 14:32:18] BLOCK: src=10.0.2.100 dst=203.0.113.50 port=4444 proto=TCP rule=IDS_Alert_Signature [2025-03-05 14:32:19] BLOCK: src=10.0.2.100 dst=203.0.113.51 port=4444 proto=TCP [2025-03-05 14:32:20] BLOCK: src=10.0.2.100 dst=203.0.113.52 port=4444 proto=TCP
Refer to the exhibit. A security analyst observes repeated outbound connection attempts from an internal server to external IP addresses on a non-standard port. What is the MOST likely interpretation?
⚠ Common exam trap
ISC2 often tests the distinction between outbound connection attempts (indicative of malware C2) and inbound connection attempts (indicative of remote access or scanning), leading candidates to mistakenly choose remote desktop or port scanning.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The server is infected with malware
Repeated outbound connection attempts from an internal server to external IP addresses on a non-standard port are a classic indicator of malware command-and-control (C2) activity. Malware often uses non-standard ports to evade detection and establish outbound communication with an external attacker. This behavior is not typical of legitimate services, which use well-known ports and protocols.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The server is being used for remote desktop access
Why it's wrong here
Remote desktop typically uses port 3389 and involves interactive sessions, not automated connections.
- ✗
The server is performing a port scan
Why it's wrong here
Port scanning typically targets multiple ports on a single host, not multiple hosts on the same port.
- ✗
The server is a legitimate mail server
Why it's wrong here
Mail servers use standard ports (25, 587) and usually connect to known mail servers.
- ✓
The server is infected with malware
Why this is correct
Beaconing to multiple external IPs on a non-standard port is a common malware behavior.
Go deeper
Related to this question
Learn chapter
Introduction to Security Principles
Key term
Standard
A standard is an agreed-upon set of rules, guidelines, or specifications that ensure consistency, compatibility, and quality across IT products, services, and processes.
Key term
Detection
Detection is the process of identifying potential security incidents or anomalies by analyzing system data, logs, and network traffic.
About these practice questions
Courseiva writes every CC question from scratch — 976 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.