On a compromised web-enabled host with outbound HTTP traffic unimpeded, what happens to IRC traffic?

• A. It bypasses the firewall and proceeds normally.
• B. It is rate-limited by the firewall.
• C. It is blocked by the application firewall.
• D. It triggers the firewall's alert but passes.

Answer: (D)

When a host is compromised and tries to use IRC for command-and-control, security devices that monitor outbound traffic can still see and identify that IRC activity even if HTTP is allowed. Application-layer inspection and IDS/IPS rules can recognize IRC patterns and raise an alert. If there isn’t an explicit rule to block IRC, the traffic is allowed to pass despite the alert. So you get visibility from the alert, but the IRC traffic continues to flow. Only with a specific block or strict egress controls would that traffic be stopped or rate-limited.