200-201 Question 303
Select 2An analyst is investigating a potential security incident involving unusual traffic on a corporate network. The traffic shows communication between a client using port 56789 and a server using port 443. What can the analyst infer about this communication based on the client and server port identity?
- A
The server is hosting a secure service, as port 443 is commonly used for HTTPS.
- B
The client is running an unauthorized server because it is using a high-numbered port.
- C
The communication is inherently malicious because port 56789 is not a standard port.
- D
The client is initiating the connection to the server, as clients typically use ephemeral ports.
Show answer and explanation
Correct answers: A, D
Explanation
This question tests the candidate's understanding of client and server port identity. Typically, servers use well-known ports (like 443 for HTTPS), while clients use ephemeral ports for initiating a connection. By analyzing the port numbers, the analyst can infer that the server is hosting a secure service, and the client is initiating the connection using an ephemeral port.
- A. Correct.
Port 443 is the standard port for HTTPS, indicating that the server is hosting a secure service. This is a valid inference based on the server port identity.
- B. Incorrect.
The use of a high-numbered port by the client does not necessarily indicate unauthorized activity. High-numbered ports are often ephemeral ports assigned dynamically for client connections.
- C. Incorrect.
There is no inherent maliciousness in using a non-standard or high-numbered port. These ports are commonly used in legitimate communication.
- D. Correct.
Clients typically use ephemeral (high-numbered) ports for initiating connections to servers, which aligns with the observed behavior of the client using port 56789.