nerdexam
(ISC)2

CISSP · Question #1499

Before implementing an internet-facing router, a network administrator ensures that the equipment is baselined/hardened according to approved configurations and settings. This action provides protecti

The correct answer is A. Blind spoofing. Hardening an internet-facing router by applying approved baseline configurations closes unnecessary services, enforces strict routing controls, and implements anti-spoofing measures like uRPF, directly mitigating blind spoofing attacks.

Submitted by viktor_hu· Mar 5, 2026Communication and Network Security

Question

Before implementing an internet-facing router, a network administrator ensures that the equipment is baselined/hardened according to approved configurations and settings. This action provides protection against which of the following attacks?

Options

  • ABlind spoofing
  • BMedia Access Control (MAC) flooding
  • CSQL injection (SQLI)
  • DRansomware

How the community answered

(36 responses)
  • A
    78% (28)
  • B
    3% (1)
  • C
    6% (2)
  • D
    14% (5)

Why each option

Hardening an internet-facing router by applying approved baseline configurations closes unnecessary services, enforces strict routing controls, and implements anti-spoofing measures like uRPF, directly mitigating blind spoofing attacks.

ABlind spoofingCorrect

Blind spoofing attacks exploit weakly configured routers by sending packets with forged source IP addresses, hoping the router will accept and forward them without verification. Router hardening includes enabling anti-spoofing controls such as Unicast Reverse Path Forwarding (uRPF), access control lists (ACLs) that block invalid source addresses, and disabling IP source routing - all of which are part of a baseline/hardened configuration that prevents an attacker from successfully spoofing packets through the device.

BMedia Access Control (MAC) flooding

MAC flooding targets network switches by overwhelming the MAC address table to force broadcast behavior, which is a Layer 2 attack not mitigated by router hardening configurations.

CSQL injection (SQLI)

SQL injection is an application-layer attack targeting web application input fields and databases, which is outside the scope of router hardening and baseline configuration.

DRansomware

Ransomware is a type of malware delivered through phishing, malicious downloads, or vulnerable endpoints - router hardening does not directly prevent ransomware infection or execution.

Concept tested: Router hardening and anti-spoofing baseline configuration

Source: https://www.cisco.com/c/en/us/support/docs/ip/unicast-reverse-path-forwarding/13786-timesavr.html

Topics

#Network hardening#Baseline security#Blind spoofing#Router security

Community Discussion

No community discussion yet for this question.

Full CISSP Practice