Exam PT0-002 topic 1 question 213 discussion

I hear you but reading the question, this seems to be in scope but you do have a valid point

The output of the netstat command shows active connections to and from the web server. The established connections on high numbered ports (58003, 40243, and 40252) are suspicious and should be investigated further. The penetration tester should attempt to identify the processes associated with those connections to determine if they are legitimate or if they represent an ongoing attack. Closing the reverse shell or contacting the client should not be done until the investigation is complete and the full extent of the compromise is understood. The finding should also be noted for inclusion in the final report.

Therefore, the penetration tester should investigate the high numbered port connections further to determine their purpose and whether they pose a threat to the system. This investigation could involve examining the processes associated with the connections, analyzing network traffic, or checking for indicators of compromise. After completing the investigation, the tester should note the findings for inclusion in the final report, along with any recommendations for remediation. The tester should also consider contacting the client immediately if the investigation reveals an ongoing attack or a significant risk to the system's security. Closing the reverse shell or contacting the client immediately may not be appropriate until the investigation of the established connections is complete.