The answer is Remote Desktop on port 3389, which should typically be disabled to reduce the attack surface. This is correct because netstat listening ports analysis reveals that RDP provides a direct graphical interface for remote administration, making it a prime target for brute-force attacks and unauthorized access. In the output, the service is bound to a specific internal IP address, indicating it is exposed on a routable interface rather than being restricted to localhost, which significantly increases the risk. On the ISC2 Certified in Cybersecurity CC exam, this tests your understanding of attack surface reduction by identifying unnecessary services—a common trap is assuming all listening ports are legitimate, but RDP is often left enabled by default on Windows servers. Remember the memory tip: “3389 is a dangerous line” because RDP on that port is a direct line into your server that attackers love to probe.
ISC2 CC Security Principles Practice Question
This CC practice question tests your understanding of security principles. Examine the command output carefully: the correct answer depends on what the output actually shows, not on general recall alone. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Exhibit
Refer to the exhibit.
```
C:\> netstat -an | find "LISTENING"
TCP 0.0.0.0:80 0.0.0.0:0 LISTENING
TCP 0.0.0.0:443 0.0.0.0:0 LISTENING
TCP 192.168.1.10:3389 0.0.0.0:0 LISTENING
```
A server administrator runs this command and sees the output. Which service is listening on a port that should typically be disabled to reduce the attack surface?
Refer to the exhibit.
```
C:\> netstat -an | find "LISTENING"
TCP 0.0.0.0:80 0.0.0.0:0 LISTENING
TCP 0.0.0.0:443 0.0.0.0:0 LISTENING
TCP 192.168.1.10:3389 0.0.0.0:0 LISTENING
```
A server administrator runs this command and sees the output. Which service is listening on a port that should typically be disabled to reduce the attack surface?
Refer to the exhibit.
```
C:\> netstat -an | find "LISTENING"
TCP 0.0.0.0:80 0.0.0.0:0 LISTENING
TCP 0.0.0.0:443 0.0.0.0:0 LISTENING
TCP 192.168.1.10:3389 0.0.0.0:0 LISTENING
```
A server administrator runs this command and sees the output. Which service is listening on a port that should typically be disabled to reduce the attack surface?
A
HTTP (port 80)
Why wrong: Port 80 (HTTP) is typically needed for web services and is not inherently a candidate for disabling.
B
Remote Desktop (port 3389)
Port 3389 (RDP) is a common attack vector and should be disabled if remote administration is not strictly required.
C
All of the above
Why wrong: HTTP and HTTPS are commonly required services, so disabling all would likely break functionality.
D
HTTPS (port 443)
Why wrong: Port 443 (HTTPS) is essential for secure web traffic and should remain enabled if needed.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Remote Desktop (port 3389)
Remote Desktop Protocol (RDP) on port 3389 is a high-risk service that should typically be disabled on servers unless absolutely necessary, as it provides a direct graphical interface for remote administration and is a common target for brute-force attacks. The output shows RDP listening on a specific internal IP (192.168.1.10), indicating it is bound to a routable interface, which increases exposure. In contrast, HTTP (port 80) and HTTPS (port 443) are standard web services that are often required for a server's function, so they are not typically disabled for attack surface reduction.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
HTTP (port 80)
Why it's wrong here
Port 80 (HTTP) is typically needed for web services and is not inherently a candidate for disabling.
✓
Remote Desktop (port 3389)
Why this is correct
Port 3389 (RDP) is a common attack vector and should be disabled if remote administration is not strictly required.
Related concept
Read the scenario before looking for a memorised answer.
✗
All of the above
Why it's wrong here
HTTP and HTTPS are commonly required services, so disabling all would likely break functionality.
✗
HTTPS (port 443)
Why it's wrong here
Port 443 (HTTPS) is essential for secure web traffic and should remain enabled if needed.
Common exam traps
Common exam trap: answer the scenario, not the keyword
ISC2 often tests the misconception that all listening ports are equally risky, but the trap here is that HTTP and HTTPS are expected services on a server, while RDP is a high-risk administrative service that should be disabled unless explicitly required.
Detailed technical explanation
How to think about this question
RDP uses TCP port 3389 and, by default, allows full desktop control, making it a prime vector for lateral movement and credential theft if exposed. The netstat command with the 'find' filter shows only listening ports; the 0.0.0.0 binding for HTTP/HTTPS means they accept connections on all interfaces, while RDP is bound to a specific IP, which is a common misconfiguration that still leaves it accessible from the local network. In real-world scenarios, attackers scan for open port 3389 and use tools like Hydra or Crowbar to perform password spraying, so disabling RDP or restricting it via VPN or Windows Firewall is a key hardening step per CIS benchmarks.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A security analyst at a medium-sized enterprise encounters this scenario during an investigation or architecture review. The correct answer reflects best practice for the specific threat or control described. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Security exam questions test whether you can match controls to threats in context — not just recall definitions.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this CC question in full detail.
Security Principles — This question tests Security Principles — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Remote Desktop (port 3389) — Remote Desktop Protocol (RDP) on port 3389 is a high-risk service that should typically be disabled on servers unless absolutely necessary, as it provides a direct graphical interface for remote administration and is a common target for brute-force attacks. The output shows RDP listening on a specific internal IP (192.168.1.10), indicating it is bound to a routable interface, which increases exposure. In contrast, HTTP (port 80) and HTTPS (port 443) are standard web services that are often required for a server's function, so they are not typically disabled for attack surface reduction.
What should I do if I get this CC question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.