An analyst reviews firewall logs and notices that a web server in the DMZ initiated an outbound connection to an external IP on port 4444. The DMZ firewall policy only allows inbound connections to the web server. What does this event most likely indicate, and what log source should be examined next?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because an outbound connection from a DMZ web server on port 4444 (a common reverse shell port) violates the expected traffic model and suggests successful exploitation followed by callback. Web access and application logs would reveal the exploit request that preceded the shell.
Full explanation below image
Full Explanation
B is correct because an outbound connection from a DMZ web server on port 4444 (a common reverse shell port) violates the expected traffic model and suggests successful exploitation followed by callback. Web access and application logs would reveal the exploit request that preceded the shell. A is wrong because Windows Update uses ports 80/443, not 4444. C is wrong because the firewall apparently did block or log the attempt (depending on policy), but even if it passed, the root cause is exploitation, not misconfiguration. D is wrong because DNS uses ports 53 (UDP/TCP), not 4444.