ITPEC FE Morning April 2018 Question 43
ITPEC FE Morning April 2018 — Question 43 of 80
Port 80 for C&C Communication — Malware uses TCP port 80 to communicate with command-and-control servers because firewalls typically allow outgoing HTTP traffic.
Port 80 is the standard HTTP port used for browsing websites. Since virtually all firewalls permit outbound traffic on this port, malware exploits this to disguise its C&C communication as normal web browsing, making it less likely to be blocked.
The correct answer is a): port 80 is used for browsing websites, so there is a high probability that communication is allowed by the firewall.
Why not the others:
- b) Incorrect — HTTPS uses port 443, not 80
- c) Incorrect — DNS name resolution uses port 53, not 80
- d) Incorrect — DNS zone transfer also uses port 53 (TCP), not 80
Key rule: Malware often uses well-known, commonly allowed ports (80, 443) to blend in with legitimate traffic and bypass firewall rules. This technique is known as port masquerading or covert channel communication.
AI-generated — may contain errors
The original exam layout is preserved in the image so diagrams, formulas, tables, and code remain accurate.
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official FE past-paper collection or Report an issue.