A senior network security engineer has been tasked to decrease the attack surface of the corporate network. Which of the following actions would protect the external network interfaces from external…

Question

Options

• ARemove contact details from the domain name registrar to prevent social engineering attacks.
• BTest external interfaces to see how they function when they process fragmented IP packets.
• CEnable a honeynet to capture and facilitate future analysis of malicious attack vectors.
• DFilter all internal ICMP message traffic, forcing attackers to use full-blown TCP port scans against

• A
  5% (1)
• B
  74% (14)
• C
  16% (3)
• D
  5% (1)

Explanation

Fragmented IP packets are often used to evade firewalls or intrusion detection systems. Port Scanning is one of the most popular reconnaissance techniques attackers use to discover services they can break into. All machines connected to a Local Area Network (LAN) or Internet run many services that listen at well-known and not so well known ports. A port scan helps the attacker find which ports are available (i.e., what service might be listing to a port). One problem, from the perspective of the attacker attempting to scan a port, is that services listening on these ports log scans. They see an incoming connection, but no data, so an error is logged. There exist a number of stealth scan techniques to avoid this. One method is a fragmented port scan. Fragmented packet Port Scan The scanner splits the TCP header into several IP fragments. This bypasses some packet filter firewalls because they cannot see a complete TCP header that can match their filter rules. Some packet filters and firewalls do queue all IP fragments, but many networks cannot afford the performance loss caused by the queuing.

No community discussion yet for this question.