A network engineer is upgrading the network perimeter and installing a new firewall, IDS. and external edge router. The IDS es reporting elevated UDP traffic and the Internal routers are reporting…

Question

Options

• AReconfigure the firewall to block external UDP traffic
• BEstablish a security baseline on the IDS.
• CBlock echo reply traffic at the firewall.
• DModify the edge router to not forward broadcast traffic

• A
  11% (4)
• B
  58% (21)
• C
  25% (9)
• D
  6% (2)

Explanation

Because the IDS and other components are newly installed, no security baseline has been established yet. Without a baseline, the IDS has no reference for what 'normal' traffic looks like, so it cannot accurately determine whether the reported UDP traffic is genuinely elevated or simply normal operating traffic. Establishing a security baseline on the IDS allows it to learn typical traffic patterns and accurately distinguish between legitimate traffic and anomalies or attacks. The other options are premature reactive measures: blocking all external UDP (A) would disrupt legitimate services like DNS and VoIP; blocking echo reply (C) targets ICMP, not UDP; and blocking broadcast forwarding (D) addresses Smurf-style amplification attacks but doesn't address the root diagnostic issue on a newly deployed system.

No community discussion yet for this question.