Cert Master

KT-NET Port anomalies

A database server suddenly listens on port 3389 internally. BEST response?

Multiple choice — select one answer

Answer choices

  1. a. Verify authorized change; if none, isolate and hunt for lateral movement
  2. b. Ignore if CPU is low, without security or identity team coordination per policy.
  3. c. Open 3389 to the internet for remote support, without security or identity team coordination per policy.
  4. d. Disable database encryption, without security or identity team coordination per policy.

Architectural breakdown & explanation

Unexpected RDP on database tiers suggests compromise or misconfiguration.

Correct answer(s): a. Verify authorized change; if none, isolate and hunt for lateral movement

Exam domain: Port anomalies (17% weight on the official guide).

Official documentation & study links

Practice this certification

This page is one question from the KeyTrain's Key Training — Network Security bank. Run a full timed practice exam with domain-weighted random questions in your browser.

Start practice exam View exam overview All certifications