Eccouncil 112-51 Exam - Topic 6 Question 33 Discussion

Actual exam question for Eccouncil's 112-51 exam

Question #: 33
Topic #: 6

Barbara, a security professional, was monitoring the loT traffic through a security solution. She identified that one of the infected devices is trying to connect with other loT devices and spread malware onto the network. Identify the port number used by the malware to spread the infection to other loT devices.

APort 25

BPort 443

CPort 110

DPort 48101

Show Suggested Answer

Suggested Answer: D

Port 48101 is the port number used by the malware to spread the infection to other loT devices. This port is associated with the Mirai botnet, which is one of the most notorious loT malware that targets vulnerable loT devices and turns them into a network of bots that can launch distributed denial-of-service (DDoS) attacks. Mirai scans the internet for loT devices that use default or weak credentials and infects them by logging in via Telnet or SSH. Once infected, the device connects to a command and control (C&C) server on port 48101 and waits for instructions. The C&C server can then direct the botnet to attack a target by sending TCP, UDP, or HTTP requests. Mirai has been responsible for some of the largest DDoS attacks in history, such as the one that disrupted Dyn DNS in 2016 and affected major websites like Twitter, Netflix, and Reddit. Reference:

Mirai (malware), Wikipedia, March 16, 2021

Mirai Botnet: A History of the Largest loT Botnet Attacks, Imperva, December 10, 2020

Mirai Botnet: How loT Devices Almost Brought Down the Internet, Cloudflare, March 17, 2021

by Sylvia at May 04, 2025, 02:31 PM

Limited Time Offer

25%

Off

Get Premium 112-51 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Sol

5 months ago

Wait, are we really sure about these port numbers? Seems off to me.

upvoted 0 times

...

Arthur

6 months ago

Port 48101 sounds suspiciously specific, could be a new trend.

upvoted 0 times

...

Kristel

6 months ago

Definitely not Port 110, that's for POP3 email.

upvoted 0 times

...

Sharee

6 months ago

Nah, I think it's Port 443, that's commonly used for secure connections.

upvoted 0 times

...

Freeman

6 months ago

I'm pretty sure it's Port 25 for email-related malware.

upvoted 0 times

...

Dawne

6 months ago

I’m leaning towards port 443 since it’s often used for secure connections, but I wonder if malware would use that to hide its activity.

upvoted 0 times

...

Magda

7 months ago

I feel like port 25 is usually associated with email, but I can't recall if it has been used for spreading malware too.

upvoted 0 times

...

Gennie

7 months ago

I think I came across a similar question in practice about IoT devices and their vulnerabilities. Port 48101 sounds like it could be a candidate for malware communication.

upvoted 0 times

...

Dante

7 months ago

I remember studying about common ports used for malware, but I'm not sure if it's one of the typical ones like 25 or 443.

upvoted 0 times

...

Jacki

7 months ago

I'm pretty confident I know the answer to this one. IoT malware often tries to spread using common, unprotected ports. Based on that, I'm going to go with option D - port 48101.

upvoted 0 times

...

Rene

7 months ago

Okay, I've got a strategy for this. I'll think about the typical ports used for common network services and protocols, and see if any of those match the options provided. That should help me narrow it down.

upvoted 0 times

...

Mammie

8 months ago

Hmm, I'm a bit unsure about this one. I know malware can use a variety of ports, but I'm not sure which one is most common for IoT devices specifically. I'll have to review my notes on IoT security.

upvoted 0 times

...

Ashley

8 months ago

This seems like a straightforward question about identifying the port used by malware to spread across IoT devices. I'll need to think carefully about the common ports used for malware and network attacks.

upvoted 0 times

...