200-201 Question 372
Single answerA security analyst is monitoring network traffic and notices a large amount of suspicious activity on TCP port 3389. To which service does this port typically correspond, and why might this activity be a concern?
- A
Secure Shell (SSH)
- B
Remote Desktop Protocol (RDP)
- C
Simple Mail Transfer Protocol (SMTP)
- D
Hypertext Transfer Protocol Secure (HTTPS)
Show answer and explanation
Correct answer: B
Explanation
TCP port 3389 is commonly used by Remote Desktop Protocol (RDP) to allow remote desktop connections to a system. Suspicious activity on this port could indicate an attacker attempting to exploit weaknesses in RDP to gain unauthorized access. Monitoring traffic on this port is crucial for identifying and mitigating potential threats to system security.
- A. Incorrect.
TCP port 22 is used by Secure Shell (SSH) for secure remote access. The observed activity on port 3389 is unrelated to SSH.
- B. Correct.
TCP port 3389 is used by Remote Desktop Protocol (RDP), a service for remote desktop connections. Suspicious activity on this port could indicate an attempted unauthorized access to a system using RDP.
- C. Incorrect.
TCP port 25 is used by Simple Mail Transfer Protocol (SMTP) for email transmission. The activity on port 3389 does not relate to SMTP.
- D. Incorrect.
TCP port 443 is used by Hypertext Transfer Protocol Secure (HTTPS) for secure web traffic. The activity on port 3389 is unrelated to HTTPS.