A network analyst notices a long spike in traffic on port 1433 between two IP addresses on opposite sides of a WAN connection. Which of the following is the most likely cause?

Question

Options

• AA local red team member is enumerating the local RFC1918 segment to enumerate hosts
• BA threat actor has a foothold on the network and is sending out control beacons
• CAn administrator executed a new database replication process without notifying the SOC
• DAn insider threat actor is running Responder on the local segment, creating traffic replication

• A
  10% (5)
• B
  4% (2)
• C
  65% (33)
• D
  22% (11)

Explanation

Port 1433 and Database Replication

Port 1433 is the default port for Microsoft SQL Server, making a large, sustained traffic spike between two endpoints the hallmark of a database replication or synchronization event - a common administrative task where large datasets are transferred across WAN links. Option C is correct because an unannounced database replication job perfectly explains both the specific port and the prolonged, high-volume nature of the spike.

Why the distractors are wrong:

• A is wrong because host enumeration on an RFC1918 segment would generate broad scanning traffic across many IPs and ports, not a sustained bilateral spike on a single port across a WAN
• B is wrong because C2 (command-and-control) beacons are typically low and slow - small, periodic packets designed to avoid detection, not long traffic spikes
• D is wrong because Responder is a credential-harvesting tool targeting LLMNR/NBT-NS on local segments, which has no logical connection to port 1433 or WAN traffic

Memory Tip: Think "1433 = SQL Server = Big Data Movement" - whenever you see a large, sustained spike on port 1433 across a WAN, think database replication before jumping to malicious conclusions. Always consider the benign administrative explanation first when the traffic pattern fits a known legitimate process.

No community discussion yet for this question.