CAS-001 · Question #530
The Information Security Officer (ISO) believes that the company has been targeted by cybercriminals and it is under a cyber attack. Internal services that are normally available to the public via…
The correct answer is A. After the senior engineer used a network analyzer to identify an active Fraggle attack, the. The packet capture log shows UDP traffic targeting port 19 (chargen) on the company's router from multiple source IPs, which is the defining characteristic of a Fraggle attack identified via a network/protocol analyzer.
Question
The Information Security Officer (ISO) believes that the company has been targeted by cybercriminals and it is under a cyber attack. Internal services that are normally available to the public via the Internet are inaccessible, and employees in the office are unable to browse the Internet. The senior security engineer starts by reviewing the bandwidth at the border router, and notices that the incoming bandwidth on the router's external interface is maxed out. The security engineer then inspects the following piece of log to try and determine the reason for the downtime, focusing on the company's external router's IP which is 128.20.176.19:
11:16:22.110343 IP 90.237.31.27.19 > 128.20.176.19.19: UDP, length 1400 11:16:22.110351 IP 23.27.112.200.19 > 128.20.176.19.19: UDP, length 1400 11:16:22.110358 IP 192.200.132.213.19 > 128.20.176.19.19: UDP, length 1400 11:16:22.110402 IP 70.192.2.55.19 > 128.20.176.19.19: UDP, length 1400 11:16:22.110406 IP 112.201.7.39.19 > 128.20.176.19.19: UDP, length 1400 Which of the following describes the findings the senior security engineer should report to the ISO and the BEST solution for service restoration?
Options
- AAfter the senior engineer used a network analyzer to identify an active Fraggle attack, the
- BAfter the senior engineer used the above IPS logs to detect the ongoing DDOS attack, an IPS
- CAfter the senior engineer used a mirror port to capture the ongoing amplification attack, a BGP
- DAfter the senior engineer used a packet capture to identify an active Smurf attack, an ACL should
How the community answered
(36 responses)- A64% (23)
- B19% (7)
- C11% (4)
- D6% (2)
Why each option
The packet capture log shows UDP traffic targeting port 19 (chargen) on the company's router from multiple source IPs, which is the defining characteristic of a Fraggle attack identified via a network/protocol analyzer.
A Fraggle attack floods a victim with UDP packets directed at port 7 (echo) or port 19 (chargen); the log shows multiple source IPs sending UDP to port 19 on the company's external IP (128.20.176.19), which matches this pattern exactly. A network analyzer (protocol analyzer/packet sniffer such as Wireshark or tcpdump) is the correct tool used to capture and identify this traffic, and blocking the attack requires an ACL or similar filter on the border device.
The log shown is tcpdump-style packet capture output, not IPS log output; additionally, labeling it generically as a DDoS does not identify the specific attack type indicated by the chargen port usage.
While a mirror/SPAN port can feed traffic to a capture tool, the log format is standard tcpdump output rather than a separate mirror-port capture; and identifying the traffic as a generic amplification attack rather than specifically a Fraggle attack is less precise.
A Smurf attack relies on ICMP echo requests sent to broadcast addresses with a spoofed source IP, not UDP; the log explicitly shows UDP traffic, which rules out a Smurf attack.
Concept tested: Fraggle attack identification via packet capture analysis
Source: https://www.cisa.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf
Topics
Community Discussion
No community discussion yet for this question.