212-82: Certified Cybersecurity TechnicianDemo

By ECCouncil · Question Mode

QuestionQ26

Network Monitoring and Analysis

As a network security analyst for a video game development company, you are responsible for monitoring traffic patterns on the development server used by programmers.

During business hours, you observe a steady stream of data packets between the server and internal programmer workstations. Most of this traffic uses TCP connections on port 22 (SSH) and port 5900 (VNC).

Based on this scenario, what does this describe?

  • A Traffic seems normal - SSH and VNC are commonly used by programmers for secure remote access and collaboration.
  • B The situation is inconclusive - Further investigation is necessary to determine the nature of the traffic.
  • C Traffic is because of malware infection - Frequently used SSH & VNC Ports could indicate malware spreading through the Network.
  • D Traffic appears suspicious - The presence of encrypted connections might indicate attempts to conceal malicious activities.
Explanation

SSH commonly uses TCP port 22 for secure remote access, while VNC commonly uses TCP port 5900 for remote graphical desktop access. Regular business-hours connections between internal programmer workstations and a development server using these services are consistent with ordinary development and administration activity.

Community Discussion

No comments yet. Be the first to start the discussion!