200-201 Question 272
Single answerA SOC analyst is investigating suspicious traffic on the network. They observe multiple connection attempts from an external IP address targeting destination port 3389 on a server within the corporate network. What could the traffic most likely indicate?
- A
A legitimate user attempting to access a web application
- B
A potential brute-force attack on Remote Desktop Protocol (RDP)
- C
A DNS query to resolve a domain name
- D
A routine ICMP echo request (ping)
Show answer and explanation
Correct answer: B
Explanation
Port numbers are critical for identifying the purpose of network traffic. Destination port 3389 is used by Remote Desktop Protocol (RDP), which is often targeted by attackers attempting to gain unauthorized access through brute-force attacks. The observed behavior of multiple connection attempts from an external IP address matches the characteristics of such an attack.
- A. Incorrect.
Destination port 3389 is not associated with web applications, which typically use ports like 80 (HTTP) or 443 (HTTPS). This option is incorrect.
- B. Correct.
Port 3389 is commonly used for Remote Desktop Protocol (RDP). Multiple connection attempts to this port from an external IP could indicate a brute-force attack. This is the correct answer.
- C. Incorrect.
DNS queries typically use port 53, not port 3389. This option is incorrect.
- D. Incorrect.
ICMP echo requests (ping) do not use TCP or UDP ports like 3389. This option is incorrect.