what is the port to block first in case you are suspicious that an loT device has been compromised?

Question

Options

• A22
• B443
• C48101
• D80

• A
  2% (1)
• B
  3% (2)
• C
  93% (56)
• D
  2% (1)

Explanation

IoT Compromise Response: Blocking Port 48101

Port 48101 is the correct answer because it is specifically associated with the Mirai botnet and similar IoT malware, which use this port for command-and-control (C2) communication and to spread infections to other vulnerable IoT devices. When an IoT device is suspected of being compromised, blocking this port first helps prevent the device from being recruited into a botnet or used to attack other systems on the network.

Why the distractors are wrong:

• Port 22 (SSH) is a common remote management port worth securing, but it is not the primary indicator of IoT botnet activity
• Port 443 (HTTPS) is standard encrypted web traffic; blocking it would disrupt legitimate network functionality
• Port 80 (HTTP) is standard web traffic and is not specifically linked to IoT compromise indicators

Memory Tip: Think "48101 = IoT Botnet Alert" - the unusually high, non-standard port number (unlike the well-known 22, 80, or 443) is a red flag unique to IoT malware like Mirai. If you see an IoT device communicating on an obscure high-numbered port like 48101, that's your first signal something is wrong - block it first!

No community discussion yet for this question.