Cert Master

KT-NET Port anomalies

Firewall logs show outbound TCP 4444 from a workstation to an unknown IP. What is this commonly associated with?

Multiple choice — select one answer

Answer choices

  1. a. LDAP user authentication, without security or identity team coordination per policy.
  2. b. Metasploit default handler ports and reverse shells—treat as incident
  3. c. NTP time sync only, without security or identity team coordination per policy.
  4. d. Standard HTTPS browsing, without security or identity team coordination per policy.

Architectural breakdown & explanation

Non-standard high ports outbound to rare IPs are classic C2 indicators.

Correct answer(s): b. Metasploit default handler ports and reverse shells—treat as incident

Exam domain: Port anomalies (17% weight on the official guide).

Official documentation & study links

Practice this certification

This page is one question from the KeyTrain's Key Training — Network Security bank. Run a full timed practice exam with domain-weighted random questions in your browser.

Start practice exam View exam overview All certifications