200-201 Question 270
Single answerA cybersecurity analyst is investigating suspicious traffic originating from a corporate workstation. The analyst notices that the source port for the outbound traffic is consistently set to port 80. Which of the following is the MOST likely reason for this behavior?
- A
The workstation is running a web server that is misconfigured or compromised.
- B
The workstation is using a non-standard source port for regular HTTP traffic.
- C
An attacker is using port 80 as the source port to evade firewall rules.
- D
The source port is dynamically assigned by the operating system for outbound communication.
Show answer and explanation
Correct answer: C
Explanation
In normal network operations, the source port is typically a dynamically assigned ephemeral port, not a well-known port like 80. If outbound traffic consistently uses port 80 as the source port, it is likely an attempt by an attacker to bypass firewall rules that permit HTTP traffic. Understanding these patterns is critical for detecting malicious activity in network traffic.
- A. Incorrect.
This is unlikely because port 80 is typically used as a destination port for web servers, not as a source port for outbound traffic.
- B. Incorrect.
This option is incorrect as port 80 is not a non-standard source port for regular HTTP traffic. Source ports are usually ephemeral and not fixed to port 80.
- C. Correct.
This is the correct answer because attackers may use a well-known port like 80 as the source port to bypass firewalls that allow HTTP traffic.
- D. Incorrect.
This is incorrect because dynamically assigned source ports are usually ephemeral and chosen from a range, not fixed to port 80.