nerdexam
EC-Council

212-82 · Question #134

As a network security analyst for a video game development company, you are responsible for monitoring the traffic patterns on the development server used by programmers. During business hours, you…

The correct answer is B. Traffic seems normal SSH and VNC are commonly used by programmers for secure remote. The observed traffic patterns of SSH and VNC connections between a development server and programmer workstations during business hours are normal, as these protocols are standard for secure remote access and collaboration in development environments.

Submitted by jian89· Mar 6, 2026Cloud Security Operations & Incident Response

Question

As a network security analyst for a video game development company, you are responsible for monitoring the traffic patterns on the development server used by programmers. During business hours, you notice a steady stream of data packets moving between the server and internal programmer workstations. Most of this traffic is utilizing TCP connections on port 22 (SSH) and port 5900 (VNC). Based on this scenario, what does it describe?

Options

  • ATraffic appears suspicious - The presence of encrypted connections might indicate attempts to
  • BTraffic seems normal SSH and VNC are commonly used by programmers for secure remote
  • CTraffic is because of malware infection - Frequently used SSH & VNC Ports could indicate
  • DThe situation is inconclusive - Further investigation is necessary to determine the nature of the

How the community answered

(46 responses)
  • A
    7% (3)
  • B
    78% (36)
  • C
    13% (6)
  • D
    2% (1)

Why each option

The observed traffic patterns of SSH and VNC connections between a development server and programmer workstations during business hours are normal, as these protocols are standard for secure remote access and collaboration in development environments.

ATraffic appears suspicious - The presence of encrypted connections might indicate attempts to

Encrypted connections like SSH are a cybersecurity best practice for secure communication and do not inherently indicate suspicious activity; rather, they suggest legitimate secure remote access.

BTraffic seems normal SSH and VNC are commonly used by programmers for secure remoteCorrect

Traffic seems normal because SSH (Secure Shell) on port 22 and VNC (Virtual Network Computing) on port 5900 are commonly used by programmers for secure remote access, command-line operations, file transfers, and graphical desktop sharing to development servers. These activities are typical during business hours in a video game development company.

CTraffic is because of malware infection - Frequently used SSH & VNC Ports could indicate

While malware can utilize various ports, attributing the traffic solely to a malware infection without additional indicators of compromise, especially when the activity aligns with normal development operations, is an incorrect assumption.

DThe situation is inconclusive - Further investigation is necessary to determine the nature of the

Based on the context of a development server, programmers, and common usage of SSH and VNC during business hours, the situation is not inconclusive; the traffic pattern is consistent with legitimate and expected activities.

Concept tested: Network traffic analysis, common service ports

Source: https://learn.microsoft.com/en-us/windows-server/administration/openssh/openssh_overview

Topics

#Network monitoring#SSH#VNC#Traffic analysis

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 212-82 Practice