ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

TCP port 6667 is the default port for Internet Relay Chat (IRC). Many botnets continue to rely on IRC channels for command-and-control (C2). A hallmark of such infections is that compromised hosts open a persistent outbound connection to the IRC server and receive small command messages over that link. NTP reflection activity would involve high-volume UDP traffic to port 123, not a steady TCP session on 6667. Legitimate time synchronization also uses UDP 123 and targets a small, static list of servers. SQL injection attacks travel over HTTP/HTTPS or database service ports such as 1433 or 3306, and do not require IRC. Therefore, the observed pattern most strongly indicates an IRC-based botnet C2 connection.