Exam SY0-701 topic 1 question 303 discussion

This is so badly worded..

A. A web shell has been deployed to the server through the page. The shell would allow the attacker to gain unauthorized access and control over the server.

The uploaded image file is actually a web shell.

A company web server is initiating outbound traffic to a low-reputation, public IP on a non-standard port. The web server is used to present an unauthenticated page to clients who upload images. An analyst notices a suspicious process running on the server that was not created by the company development team. Which of the following is the most likely explanation for this security incident? o The web server allows image uploads from clients. If the file upload functionality is not secure (e.g., lacking file type validation or size checks), attackers could upload a malicious script disguised as an image. o The suspicious process observed by the analyst could be the result of a web shell that the attackers are using to control the server or initiate outbound traffic to a low-reputation IP. o The outbound traffic to a low-reputation public IP and use of a non-standard port are consistent with command-and-control (C2) communication often associated with web shell activity.