A new malware spreads over UDP Port 8320 and several network hosts have been infected. A new security administrator has determined a possible cause, and the infected machines have been quarantined…

Question

Options

• ALimit source ports on the firewall to specific IP addresses.
• BAdd an explicit deny-all and log rule as the final entry of the firewall rulebase.
• CImplement stateful UDP filtering on UDP ports above 1024.
• DConfigure the firewall to use IPv6 by default.

• A
  13% (3)
• B
  78% (18)
• C
  4% (1)
• D
  4% (1)

Explanation

Adding an explicit deny-all rule with logging as the final entry in the firewall ruleset is a fundamental firewall best practice ('default deny' stance). Firewalls process rules top-to-bottom; without a terminal deny-all, unmatched traffic may be implicitly permitted depending on the firewall's default action. An explicit deny-all also enables logging of all blocked traffic, providing visibility into ongoing attack attempts. Option A (limit source ports to specific IPs) does not stop the malware's spread - infected hosts within the network could still use any source port. Option C (stateful UDP filtering above 1024) might help but is incomplete since the threat is on port 8320 specifically and the broader hygiene fix is a default-deny posture. Option D (switching to IPv6) does not address UDP port-based malware propagation.

No community discussion yet for this question.