200-201 Question 371
Single answerA cybersecurity analyst is investigating suspicious network activity on a corporate network. They observe a large number of connections targeting TCP port 22 on multiple servers. Which protocol is most likely being targeted, and what is the primary use of this port?
- A
FTP, used for transferring files between systems
- B
SSH, used for secure remote access and command execution
- C
HTTP, used for web traffic and communication
- D
Telnet, used for unencrypted remote access to systems
Show answer and explanation
Correct answer: B
Explanation
Port 22 is primarily associated with the SSH (Secure Shell) protocol. SSH is widely used for secure remote login and command execution on networked systems. The observed activity targeting port 22 indicates an attempt to connect to services utilizing SSH, possibly as part of a brute-force attack or other malicious activity. Understanding port usage is critical in identifying and mitigating network threats.
- A. Incorrect.
FTP operates on ports 20 and 21, not port 22. It is used for file transfers, so this option is incorrect.
- B. Correct.
SSH operates on port 22 and is used for secure remote access and command execution. This is the correct answer.
- C. Incorrect.
HTTP operates on port 80, not port 22. It is used for web traffic, so this option is incorrect.
- D. Incorrect.
Telnet operates on port 23, not port 22. It provides unencrypted remote access, so this option is incorrect.