200-201 Question 269
Single answerA cybersecurity analyst is investigating suspicious traffic on the network and notices that multiple packets from a single external IP address are targeting an internal web server using random high-numbered source ports. What is the most likely explanation for this behavior?
- A
The external host is performing a port scan on the internal web server.
- B
The external host is engaged in a legitimate web application session.
- C
The external host is attempting a Distributed Denial of Service (DDoS) attack using spoofed source ports.
- D
The external host is using dynamic source ports as part of standard TCP/IP communication.
Show answer and explanation
Correct answer: A
Explanation
The described behavior of using random high-numbered source ports to target a specific internal web server is indicative of a port scan. Port scans are commonly used by attackers to identify open ports and services on a target machine, allowing them to plan further exploitation. This is distinct from legitimate traffic or other attack types like DDoS, which have different characteristics.
- A. Correct.
Port scanning often involves sending packets with random or incrementally changing source ports to identify open services on the target. This matches the behavior described in the scenario.
- B. Incorrect.
A legitimate web application session would not involve multiple random high-numbered source ports targeting a single internal server. Instead, it would typically use a consistent source port for the duration of the session.
- C. Incorrect.
While DDoS attacks can use spoofed source ports, they usually involve overwhelming the target with a large volume of traffic, which was not specified in this scenario.
- D. Incorrect.
Dynamic source ports are used in standard TCP/IP communication, but their behavior is not consistent with the described scenario, where random high-numbered source ports are used to target a single internal server.