Which of the following is indicative of an FTP bounce?

In an FTP bounce attack, the attacker sends a PORT command containing an arbitrary IP address that is not their own, instructing the FTP server to open a data connection to that third-party host. This allows the attacker to scan ports or relay attacks through the FTP server, making the arbitrary IP address the definitive indicator of the attack.

Reverse DNS lookups are a reconnaissance technique unrelated to the FTP bounce attack mechanism.

Same port number does not characterize an FTP bounce; the attack is defined by the destination IP manipulation, not port reuse.

A successful file transfer is normal FTP behavior and does not indicate a bounce attack.