nerdexam
Cisco

352-001 · Question #239

Which two actions can the sinkhole technique be used to perform? (Choose two.)

The correct answer is B. redirect an attack away from its target C. monitor attack noise, scans, and other activity. A sinkhole redirects malicious or unwanted traffic to a controlled destination and allows analysts to monitor that traffic, making B and C the correct answers.

Designing Security

Question

Which two actions can the sinkhole technique be used to perform? (Choose two.)

Options

  • Adelay an attack from reaching its target
  • Bredirect an attack away from its target
  • Cmonitor attack noise, scans, and other activity
  • Dreverse the direction of an attack

How the community answered

(30 responses)
  • A
    3% (1)
  • B
    93% (28)
  • D
    3% (1)

Why each option

A sinkhole redirects malicious or unwanted traffic to a controlled destination and allows analysts to monitor that traffic, making B and C the correct answers.

Adelay an attack from reaching its target

A sinkhole does not delay an attack - it redirects traffic immediately with no buffering or time-delay mechanism involved.

Bredirect an attack away from its targetCorrect

A sinkhole works by altering DNS records or routing entries so that traffic bound for a malicious or attacked destination is diverted to a controlled server, effectively pulling the attack away from its intended target.

Cmonitor attack noise, scans, and other activityCorrect

Because all redirected traffic lands on the sinkhole server, security teams can inspect it to observe attack patterns, scan behavior, botnet callbacks, and other malicious activity in a controlled and safe environment.

Dreverse the direction of an attack

A sinkhole does not reverse the direction of an attack back toward the attacker; it simply diverts traffic to a controlled monitoring point without retaliating.

Concept tested: DNS and IP sinkhole technique for attack redirection and monitoring

Source: https://www.cisco.com/c/en/us/about/security-center/intelligence-group/threat-research/sinkholes.html

Topics

#sinkhole#DDoS mitigation#traffic redirection#attack monitoring

Community Discussion

No community discussion yet for this question.

Full 352-001 Practice