mediumMultiple ChoiceObjective-mapped
SSCP Practice Question: A security analyst reviews the exhibit
Exhibit
Refer to the exhibit. [NetFlow Record] Time: 2024-03-21 10:00:00 - 10:05:00 Source IP: 10.0.0.1 Destination IP: 203.0.113.5 Port: 443 (HTTPS) Bytes: 1500 [NetFlow Record] Time: 2024-03-21 10:05:00 - 10:10:00 Source IP: 10.0.0.1 Destination IP: 203.0.113.5 Port: 443 (HTTPS) Bytes: 2000 [NetFlow Record] Time: 2024-03-21 10:10:00 - 10:15:00 Source IP: 10.0.0.1 Destination IP: 203.0.113.5 Port: 443 (HTTPS) Bytes: 2500
A security analyst reviews the exhibit. The internal IP 10.0.0.1 is a web server, and 203.0.113.5 is an external IP. What is the most likely issue?
⚠ Common exam trap
It's easy for candidates to confuse the direction of traffic—assuming any external IP communicating with a web server must be an attacker scanning or attacking, rather than recognizing that the server itself may be the compromised source of outbound data.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The web server may be exfiltrating data to an external host
The exhibit shows a high volume of outbound traffic from internal IP 10.0.0.1 (the web server) to external IP 203.0.113.5 on port 443 (HTTPS). This pattern is consistent with data exfiltration, where a compromised web server sends sensitive data to an external command-and-control (C2) server. The traffic is initiated by the internal server, not inbound, which rules out scanning or DDoS attacks.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The web server may be exfiltrating data to an external host
Why this is correct
Increasing outgoing data to a single external host is suspicious of data exfiltration.
- ✗
The external IP is scanning the web server for vulnerabilities
Why it's wrong here
Scanning would show many different ports, not just 443 with increasing data out.
- ✗
The web server is experiencing a DDoS attack from the external IP
Why it's wrong here
DDoS would typically show high volume of incoming traffic to the server.
- ✗
An internal user is browsing a malicious website
Why it's wrong here
User browsing shows small, varied flows from client to server; here server is source.
Go deeper
Related to this question
About these practice questions
One of 920 original SSCP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.