In a security automation scenario, a cybersecurity analyst is tasked with developing a Python script to automate the process of scanning a network for open ports and identifying potential vulnerabilities. The script needs to utilize the `socket` library to create connections to a range of IP addresses and ports. The analyst decides to implement a function that takes an IP address and a list of ports as input, attempts to connect to each port, and returns a list of open ports. Which of the following best describes the expected output of the function when provided with the IP address `192.168.1.1` and the ports `[22, 80, 443]` if only port 80 is open?