ECSA v10: EC-Council Certified Security Analyst v10Demo

By ECCouncil · Question Mode

QuestionQ80

Network Penetration Testing Methodology – Internal

Rebecca is a Penetration Tester at a security services firm called Xsecurity. She placed a sniffer on a subnet located deep within a client's network.

She used the Firewalk tool to assess the security of the company's network firewall. Afterward, when Rebecca reviewed the sniffer logs, she could not see any traffic generated by Firewalk.

What is the reason for this?

  • A Rebecca does not see any of the Firewalk traffic because it sets all packets with a TTL of one.
  • B Network sniffers cannot detect Firewalk so that is why none of the traffic appears.
  • C Firewalk cannot pass through firewalls.
  • D She cannot see the traffic because Firewalk sets all packets with a TTL of zero.
Explanation

Firewalk uses TTL-limited probe packets to identify how a firewall handles traffic. Packets intended to expire at the relevant hop use a TTL of one, so they do not continue deep enough into the internal network to be captured by a sniffer on a distant internal subnet.

Community Discussion

No comments yet. Be the first to start the discussion!