ITPEC FE Morning April 2018 Question 43
When malware that has made a successful intrusion into a PC communicates with a command-and-control server on the Internet, which of the following is a reason for using the TCP port number 80 as the destination port in most cases?
Explanation
Port 80 is likely to be allowed by the firewall — malware hides its command-and-control traffic in a protocol almost every network lets out.
TCP port 80 is the well-known port of HTTP, used for browsing websites. Because users need web access, firewalls commonly permit outbound connections to port 80. Malware that sends its C&C traffic there looks like ordinary web browsing and passes the firewall, whereas an unusual port would more likely be blocked or noticed.
Answer (a)
Why not others:
- •(b) — HTTPS uses TCP port 443, not 80; port 80 carries plain HTTP
- •(c) — name resolution (DNS queries) uses port 53, mostly over UDP
- •(d) — a DNS zone transfer uses TCP port 53, and firewalls usually restrict it to authorized secondary servers, so it is less likely to be allowed, not more
Key rule: Attackers use the ports the firewall must leave open for normal business (80, 443), so port filtering alone cannot stop C&C traffic; proxies and content inspection are needed.
Security · AI-written, may contain errors
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official FE past-paper collection or Report an issue.