Noticing latency issues at its connection to the Internet, a company suspects that it is being targeted in a Distributed Denial of Service attack. A security analyst discovers numerous inbound…

Question

Options

• ABlock in-bound connections to the company's NTP servers.
• BBlock IPs making monlist requests.
• CDisable the company's NTP servers.
• DDisable monlist on the company's NTP servers.

• A
  7% (3)
• B
  5% (2)
• C
  20% (8)
• D
  68% (28)

Explanation

The NTP 'monlist' command returns a list of the last 600 hosts that communicated with an NTP server. Attackers exploit this in amplification DDoS attacks: a small spoofed request causes the NTP server to send a large response to the victim. Disabling monlist (D) eliminates the attack vector while keeping NTP time-synchronization services fully operational - it removes a legacy, rarely-needed diagnostic feature with no meaningful impact on normal NTP function. Blocking all inbound connections to NTP servers (A) would break time synchronization for clients. Blocking the requesting IPs (B) is impractical because attackers spoof source IPs, so blocking them is ineffective and causes collateral damage. Disabling NTP servers entirely (C) has the highest operational impact, preventing all time synchronization.

No community discussion yet for this question.