Exam 312-50v11 topic 1 question 137 discussion

48101 https://us-cert.cisa.gov/ncas/alerts/TA16-288A

This is not an old question, i got this one on my exam 2 months ago.

it is c

Infected devices often attempt to spread malware by using port 48101 to send results to the threat actor

How to Defend Against IoT Hacking Mirai, look for suspicious traffic on port 48101. Infected devices often attempt to spread malware by using port 48101 to send results to the threat actor.Monitor traffic on port 48101 as infected devices attempt to spread malicious file. (P.2678/2662)

IOT Uses port 48101 and that is the port to monitor for potential issues then closing that port will stop IOT from communication with the network

B Cannot be the right answer, just because there was a one-off piece of malware eight years ago that used this port. Port 80 and 443 are both valid, but I would think nowadays HTTPS is more common that HTTP, so D it is.

From Viktor Afimov (Udemy's CEHv11 Practice Exams). Explanation: https://us-cert.cisa.gov/ncas/alerts/TA16-288A The question is incorrect, it is not about knowledge of the IoT security concept, but about knowledge of one of the largest DDos attacks using Mirai in 2016: On September 20, 2016, Brian Krebs’ security blog (krebsonsecurity.com) was targeted by a massive DDoS attack, one of the largest on record, exceeding 620 gigabits per second (Gbps). An IoT botnet powered by Mirai malware created the DDoS attack. The Mirai malware continuously scans the Internet for vulnerable IoT devices, which are then infected and used in botnet attacks. The Mirai bot uses a short list of 62 common default usernames and passwords to scan for vulnerable devices. Because many IoT devices are unsecured or weakly secured, this short dictionary allows the bot to access hundreds of thousands of devices. And one of Preventive Steps was: - Look for suspicious traffic on port 48101. Infected devices often attempt to spread malware by using port 48101 to send results to the threat actor.

correct

Erratum: Port 80 is answer C.

ioT uses HTTP i.e. 80. 443 is HTTPS. 48101 Is not assigned.

You should block 443

B is correct, though a weird way to put it. Ans is verifiable by process of elimination: port 22 = SSH port 80 = http port 443 = https

correct

This is old question and not on the exam anymore.

Infected devices often attempt to spread malware by using port 48101 to send results to the threat actor.

i think that 443 is the correct answer , i couldn't find any other informations on Google , so please help ?