Emily, a network security analyst, is reviewing the logs generated by a Cisco firewall after a suspected attack on the company's network. She encounters a log message related to a connection attempt…

Question

Options

• ADeny protocol connection spoof from source_address to dest_address on interface
• BICMP packet type ICMP_type denied by outbound list acl_ID src inside_address dest
• CDeny protocol reverse path check from source_address to dest_address on interface
• DDeny IP teardrop fragment (size = number, offset = number) from IP_address to IP_address

• A
  78% (36)
• B
  2% (1)
• C
  13% (6)
• D
  7% (3)

Explanation

This question aligns with CHFI v11 objectives under Network and Web Attacks and Network Log Analysis, particularly the interpretation of Cisco firewall (ASA) log messages. Cisco ASA firewalls use numeric mnemonics to categorize and describe specific security events. Understanding these mnemonics is critical for forensic investigators when reconstructing attack attempts and identifying malicious network behavior. The Cisco ASA message ID 106022 corresponds to a "Deny protocol connection spoof" event. This log entry is generated when the firewall detects a packet with a spoofed source address, meaning the packet's source IP does not match the expected routing or interface from which it was received. Such behavior is commonly associated with reconnaissance, evasion attempts, or denial-of-service attacks. CHFI v11 emphasizes that spoofed connection attempts are strong indicators of malicious activity and are frequently logged by perimeter security devices. By analyzing this log, investigators can identify attempted impersonation, trace attack origins, and correlate events across network

No community discussion yet for this question.