A new malware spreads over UDP Port 8320 and several network hosts have been infected. A new security administrator has determined a possible cause, and the infected machines have been quarantined…

Question

Options

• ALimit source ports on the firewall to specific IP addresses.
• BAdd an explicit deny-all and log rule as the final entry of the firewall rulebase.
• CImplement stateful UDP filtering on UDP ports above 1024.
• DConfigure the firewall to use IPv6 by default.

• A
  6% (3)
• B
  79% (42)
• C
  11% (6)
• D
  4% (2)

Explanation

After quarantining infected machines, the next step is to add an explicit deny-all and log rule as the final entry of the firewall rulebase (B). This is a firewall best practice: an implicit or explicit deny-all at the bottom catches any traffic not permitted by earlier rules, blocking unknown or rogue traffic on ports like 8320. Logging the denied traffic also provides visibility into ongoing infection attempts from undetected hosts. Limiting source ports to specific IPs (A) is impractical without knowing all legitimate sources. Stateful UDP filtering above port 1024 (C) is useful but doesn't address the root issue of missing deny rules. Switching to IPv6 (D) does nothing to mitigate a specific UDP port threat.

No community discussion yet for this question.