A systems administrator notices a surge of network traffic is coming from the monitoring server. The administrator discovers that large amounts of data are being downloaded to an external source…

The correct answer is E. Port 8048. Port 8048 is a non-standard, uncommon port that is not associated with any well-known legitimate service. The logs referenced in the question would show outbound traffic on port 8048 being used to exfiltrate data to an external source. Attackers frequently use obscure…

Security

Question

A systems administrator notices a surge of network traffic is coming from the monitoring server. The administrator discovers that large amounts of data are being downloaded to an external source. While investigating, the administrator reviews the following logs:

Which of the following ports has been compromised?

Exhibit

Options

APort 20
BPort 22
CPort 443
DPort 4443
EPort 8048

How the community answered

(26 responses)

B
4% (1)
C
15% (4)
D
4% (1)
E
77% (20)

Explanation

Port 8048 is a non-standard, uncommon port that is not associated with any well-known legitimate service. The logs referenced in the question would show outbound traffic on port 8048 being used to exfiltrate data to an external source. Attackers frequently use obscure high-numbered ports to evade detection since firewall rules and monitoring tools are typically tuned for well-known ports. Port 20 (FTP data), Port 22 (SSH), Port 443 (HTTPS), and Port 4443 (alternate HTTPS) are all standard ports with legitimate uses. An unusual port like 8048 carrying large volumes of outbound data is a strong indicator of compromise and data exfiltration.

Topics

#Network ports#Security incidents#Data exfiltration#Monitoring

Community Discussion

No community discussion yet for this question.

Full CV0-004 Practice