QuestionQ51

Scanning and Mapping

Adam is a Security Administrator for Umbrella Inc. He has been tasked with securing access to the company network from every possible entry point. He segmented the network into several subnets and deployed firewalls throughout the network. He configured very strict rules on every firewall, blocking all inbound and outbound traffic except the ports that are required. Port 80 must remain open because the company hosts a website that must be reachable from the Internet. Adam remains concerned about programs such as Hping2 that can enter a network through covert channels.

Which of the following is the most effective method to protect the company network from an attacker using Hping2 to scan its internal network?

  • A Block all outgoing traffic on port 21
  • B Block all outgoing traffic on port 53
  • C Block ICMP type 13 messages
  • D Block ICMP type 3 messages
Explanation

ICMP type 13 is an ICMP Timestamp Request. Filtering these messages prevents the use of ICMP timestamp probes that Hping2 can craft for host discovery or covert-channel scanning. ICMP type 3 controls Destination Unreachable messages, while blocking outbound FTP or DNS traffic does not stop this ICMP technique.

Community Discussion

No comments yet. Be the first to start the discussion!