Free EC-Council 312-50V13 CEH V13 Actual Exam Questions - Question 8 Discussion

Guessing D since port 22 usually means SSH and high port is client side.

It’s D because port 22 is SSH and the first IP uses a high port, typical for clients.

Looks like the key is the port number 22, which is standard for SSH. Since the first IP is connected from a high port to port 22, it makes sense that 10.240.250.23 is the client and 10.249.253.15 is the server, so D fits best. Also, option C is off because even though SSH encrypts data, the log still shows IP roles clearly from connection info.

Port 22 confirms SSH, and common log order places client first, so D.

Port 22 is SSH and the first IP is almost always the client, so D.

D imo since port 22 is SSH and client IP usually listed first in logs.

It’s D because port 22 means SSH and client usually comes before server in logs.

D. Port 22 is a pretty clear giveaway for SSH, so options mentioning FTP can be ruled out. Also, the standard logging format generally lists the client IP first and server second, so the first IP should be the client. C is off because even if SSH is encrypted, you can usually tell the client and server from connection details in logs. So this log matches perfectly with D’s description.

Maybe D since port 22 definitely means SSH, and logs usually list the client IP before the server IP. A and B mix roles up or mention FTP which doesn't fit here.

Not C, you can tell client/server from IP order here.

D looks right since port 22 is SSH and the first IP usually is the client, second is server in logs like this. Seems straightforward enough.