Identifying Backdoors from External Network Traffic

SY0-601 By islever Editorial Last updated

Short answer

D The software contained a backdoor, allowing unauthorized external access via an uncommon port.

Question

A user downloaded software from an online forum. After the user installed the software, the security team observed external network traffic connecting to the user's computer on an uncommon port. Which of the following is the most likely explanation of this unauthorized connection?
  1. The software had a hidden keylogger.
  2. The software was ransomware.
  3. The user’s computer had a fileless virus.
  4. The software contained a backdoor. Correct Answer

Key Takeaways

The core trap is distinguishing between data exfiltration (keylogger) and persistent access (backdoor); unusual inbound traffic specifically points to a backdoor.

This question tests the ability to identify malware types based on post-installation network behavior. The correct answer is D, as external connections on uncommon ports indicate a backdoor facilitating unauthorized remote access.

Common mistake: Candidates often choose A (Keylogger) because it involves sending data out, but keyloggers typically initiate outbound connections to send stolen data rather than accepting incoming control connections.

Expert Analysis

Why the Answer Is Correct

A backdoor is a method bypassing normal authentication to gain remote access to a system. When software downloaded from an untrusted source contains a backdoor, it often opens a listening port or initiates a connection to a Command and Control (C2) server. The observation of "external network traffic connecting to the user's computer" implies an inbound connection attempt or an established session initiated by the malware to allow attacker control, which is the defining characteristic of a backdoor.

Why the Other Options Are Wrong

Option A (Keylogger) primarily focuses on capturing input; while it sends data out, it does not typically establish a persistent inbound channel for remote control. Option B (Ransomware) is designed to encrypt files locally and demand payment, not to maintain a remote administrative shell. Option C (Fileless virus) refers to malware that runs in memory without writing to disk; while possible, the explicit mention of downloading and installing specific software makes a traditional infected executable with a backdoor the most direct explanation for the observed connectivity.

Community Comment Notes

The community consensus strongly supports D, with users noting that backdoors are specifically designed to enable unauthorized remote access. One commenter highlighted that while keyloggers might use uncommon ports, they don't provide the same level of remote control evidence as a backdoor. Another user emphasized that ransomware encrypts files rather than connecting externally for control purposes.

Exam Strategy

When analyzing malware symptoms, look for the purpose of the network activity: 'sending data out' suggests spyware/keyloggers, while 'accepting connections' or 'remote control' suggests backdoors or RATs (Remote Access Trojans). Always prioritize the primary function described in the scenario.

Frequently Asked Questions

Why isn't this a keylogger if it uses an uncommon port?

Keyloggers typically send data outbound to a collector. An inbound connection or a persistent channel for remote control is characteristic of a backdoor.

Could fileless malware cause this?

Fileless malware operates in memory, but the scenario specifies downloading and installing software, making a standard infected executable with a backdoor the more likely root cause.

More SY0-601 FAQ →

Community Votes

D
100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

  1. ps1hacker 👍 9 Answered D
    Backdoor because: A: keylogger logs keys and it may use a uncommon port to report its logs, but I dont think its enough evidence to determine thats the case. B: ransomware encrypts files but doesnt connect externally. C: Fileless virus - no cause they downloaded software D: Backdoor - yes, the file downloaded contained a backdoor and its calling 'home'.
  2. Ravnit 👍 2
    D. A backdoor is a piece of software that enables unauthorized access to a computer system. In this scenario, the fact that external network traffic is connecting to the user's computer on an uncommon port suggests that the software may have included a backdoor, allowing remote access or control of the compromised system by an external attacker.
  3. shady23 👍 1 Answered D
    The software contained a backdoor.
  4. MortG7 👍 4
    D. Backdoor

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

MFA and Patch Management Control Type and Category

S-grade

Threat Hunting Data Sources for Exploitable Systems

S-grade

Full Weekly and Differential Daily Backup Strategy

S-grade

Access Auditing as the SaaS Vendor Risk to Focus On

S-grade

← Back to SY0-601 Study Guide