nerdexam
EC-Council

312-50V9 · Question #362

You've just discovered a server that is currently active within the same network with the machine you recently compromised. You ping it but it did not respond. What could be the case?

The correct answer is C. ICMP could be disabled on the target server. When a host does not respond to a ping (ICMP echo request), the most common technical cause is that ICMP is disabled or blocked by a host-based firewall or network policy on that server.

Scanning Networks

Question

You've just discovered a server that is currently active within the same network with the machine you recently compromised. You ping it but it did not respond. What could be the case?

Options

  • ATCP/IP doesn't support ICMP
  • BARP is disabled on the target server
  • CICMP could be disabled on the target server
  • DYou need to run the ping command with root privileges

How the community answered

(30 responses)
  • A
    7% (2)
  • B
    3% (1)
  • C
    90% (27)

Why each option

When a host does not respond to a ping (ICMP echo request), the most common technical cause is that ICMP is disabled or blocked by a host-based firewall or network policy on that server.

ATCP/IP doesn't support ICMP

ICMP is a core protocol within the TCP/IP suite defined in RFC 792, so this statement is factually incorrect - TCP/IP fully supports ICMP.

BARP is disabled on the target server

ARP operates at Layer 2 to resolve IP addresses to MAC addresses; if ARP were completely disabled, no Layer 3 communication including ICMP would work at all, but the scenario states you discovered the server is active, making total ARP failure unlikely as the specific cause.

CICMP could be disabled on the target serverCorrect

ICMP echo requests can be explicitly disabled on a server through host-based firewall rules, OS-level settings, or network security policies - this is a common hardening practice. When ICMP is blocked, the server will silently drop all ping packets and return no response, making it appear unreachable even though it is active on the network. This is independent of whether TCP or other protocols are functioning normally.

DYou need to run the ping command with root privileges

On most modern operating systems the ping command can be executed by regular users without root or administrator privileges, so lack of elevated privileges is not the reason for no response.

Concept tested: ICMP blocking and host-based firewall behavior

Source: https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-firewall/create-an-inbound-icmp-rule

Topics

#ICMP#ping#firewall rules#network troubleshooting

Community Discussion

No community discussion yet for this question.

Full 312-50V9 Practice