350-201 · Question #53
An engineer is analyzing a possible compromise that happened a week ago when the company database servers unexpectedly went down. The analysis reveals that attackers tampered with Microsoft SQL…
The correct answer is A. firewall E. IPS. The attack exploits the Microsoft SQL Server Resolution Protocol (UDP port 1434), enabling DDoS. A firewall and IPS together provide the detection and blocking needed to prevent recurrence.
Question
An engineer is analyzing a possible compromise that happened a week ago when the company database servers unexpectedly went down. The analysis reveals that attackers tampered with Microsoft SQL Server Resolution Protocol and launched a DDoS attack. The engineer must act quickly to ensure that all systems are protected. Which two tools should be used to detect and mitigate this type of future attack? (Choose two.)
Options
- Afirewall
- BWireshark
- Cautopsy
- DSHA512
- EIPS
How the community answered
(43 responses)- A79% (34)
- B14% (6)
- C2% (1)
- D5% (2)
Why each option
The attack exploits the Microsoft SQL Server Resolution Protocol (UDP port 1434), enabling DDoS. A firewall and IPS together provide the detection and blocking needed to prevent recurrence.
A firewall can block UDP port 1434, which is used by the SQL Server Resolution Protocol, directly preventing attackers from sending malformed packets to trigger the DDoS condition.
Wireshark is a passive packet capture and analysis tool that provides visibility but cannot actively block or mitigate an ongoing or future DDoS attack.
Autopsy is a digital forensics tool used for post-incident disk and file analysis, not for real-time network attack detection or prevention.
SHA512 is a cryptographic hashing algorithm used for data integrity verification, not for detecting or blocking network-based DDoS attacks.
An IPS can detect anomalous traffic patterns and signatures associated with SQL Server Resolution Protocol abuse, then automatically drop or rate-limit those packets before they cause service disruption.
Concept tested: Network DDoS mitigation using firewall and IPS
Source: https://learn.microsoft.com/en-us/sql/sql-server/install/configure-the-windows-firewall-to-allow-sql-server-access
Topics
Community Discussion
No community discussion yet for this question.