An international e-commerce company has identified attack traffic originating from a whitelisted third party's IP address used to mask the third party's internal network. The security team needs to…

Question

Options

• AAsk the third-party vendor to block the attack traffic
• BConfigure the third party's proxy to begin sending X-Forwarded-For headers
• CConfigure the e-commerce company's IPS to inspect HTTP traffic
• DPerform a vulnerability scan against the network perimeter and remediate any issues identified

• A
  4% (2)
• B
  62% (31)
• C
  20% (10)
• D
  14% (7)

Explanation

The third party's proxy is forwarding all requests under a single whitelisted IP, masking the true source of the attack. The X-Forwarded-For HTTP header is a standard mechanism that proxy servers use to pass along the original client IP address in HTTP requests. By configuring the third-party proxy to include X-Forwarded-For headers, the e-commerce company can see the real IP address of the attacker behind the proxy and create targeted blocks on just that IP, leaving legitimate vendor traffic unaffected. Asking the vendor to block the traffic (A) depends on their cooperation and ability to identify it. Configuring the IPS to inspect HTTP traffic (C) helps detect attacks but still cannot differentiate attacker IPs without the forwarding header. A vulnerability scan (D) identifies weaknesses in the perimeter but does not help identify or block specific attack sources.

No community discussion yet for this question.