nerdexam
EC-Council

312-49 · Question #330

Study the log given below and answer the following question: Apr 24 14:46:46 [4663]: spp_portscan: portscan detected from 194.222.156.169 Apr 24 14:46:46 [4663]: IDS27/FIN Scan…

The correct answer is A. Disallow UDP 53 in from outside to DNS server. The IDS log shows multiple external hosts performing DNS-version-query attacks against the internal DNS server (172.16.1.107) on UDP port 53. These queries probe the DNS software version, which attackers use for reconnaissance to identify exploitable vulnerabilities. The…

Submitted by yuriko_h· Apr 18, 2026Network Forensics

Question

Study the log given below and answer the following question:

Apr 24 14:46:46 [4663]: spp_portscan: portscan detected from 194.222.156.169 Apr 24 14:46:46 [4663]: IDS27/FIN Scan: 194.222.156.169:56693 -> 172.16.1.107:482 Apr 24 18:01:05 [4663]: IDS/DNS-version-query: 212.244.97.121:3485 -> 172.16.1.107:53 Apr 24 19:04:01 [4663]: IDS213/ftp-passwd-retrieval:

194.222.156.169:1425 -> 172.16.1.107:21 Apr 25 08:02:41 [5875]: spp_portscan: PORTSCAN DETECTED from 24.9.255.53 Apr 25 02:08:07 [5875]: IDS277/DNS-version-query: 63.226.81.13:4499 -> 172.16.1.107:53 Apr 25 02:08:07 [5875]: IDS277/DNS-version-query: 63.226.81.13:4630 -> 172.16.1.101:53 Apr 25 02:38:17 [5875]: IDS/RPC-rpcinfo-query: 212.251.1.94:642 -> 172.16.1.107:111 Apr 25 19:37:32 [5875]: IDS230/web-cgi-space-wildcard:

198.173.35.164:4221 -> 172.16.1.107:80 Apr 26 05:45:12 [6283]: IDS212/dns-zone-transfer: 38.31.107.87:2291 -> 172.16.1.101:53 Apr 26 06:43:05 [6283]: IDS181/nops-x86: 63.226.81.13:1351 -> 172.16.1.107:53 Apr 26 06:44:25 victim7 PAM_pwdb[12509]: (login) session opened for user simple by (uid=0) Apr 26 06:44:36 victim7 PAM_pwdb[12521]: (su) session opened for user simon by simple(uid=506) Apr 26 06:45:34 [6283]: IDS175/socks-probe: 24.112.167.35:20 -> 172.16.1.107:1080 Apr 26 06:52:10 [6283]: IDS127/telnet-login-incorrect: 172.16.1.107:23 -> 213.28.22.189:4558 Precautionary measures to prevent this attack would include writing firewall rules. Of these firewall rules, which among the following would be appropriate?

Options

  • ADisallow UDP 53 in from outside to DNS server
  • BAllow UDP 53 in from DNS server to outside
  • CDisallow TCP 53 in from secondaries or ISP server to DNS server
  • DBlock all UDP traffic

How the community answered

(44 responses)
  • A
    82% (36)
  • B
    2% (1)
  • C
    11% (5)
  • D
    5% (2)

Explanation

The IDS log shows multiple external hosts performing DNS-version-query attacks against the internal DNS server (172.16.1.107) on UDP port 53. These queries probe the DNS software version, which attackers use for reconnaissance to identify exploitable vulnerabilities. The correct mitigation is to block inbound UDP port 53 from external sources to the DNS server. Internal resolvers need to send queries outbound on UDP 53, but external hosts should not be able to directly query or probe the internal DNS server. Option B would allow responses out (which is needed) but does not block the attack vector. Option D is too broad and would break legitimate DNS functionality.

Topics

#DNS Security#Firewall Rules#Network Reconnaissance#Log Analysis

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 312-49 Practice