nerdexam
(ISC)2

CSSLP · Question #260

In which of the following IDS evasion attacks does an attacker send a data packet such that IDS accepts the data packet but the host computer rejects it?

The correct answer is D. Insertion attack. The question describes an IDS evasion technique where a data packet is accepted by the IDS but rejected by the target host.

Secure Software Deployment, Operations, Maintenance

Question

In which of the following IDS evasion attacks does an attacker send a data packet such that IDS accepts the data packet but the host computer rejects it?

Options

  • AEvasion attack
  • BFragmentation overlap attack
  • CFragmentation overwrite attack
  • DInsertion attack

How the community answered

(29 responses)
  • A
    3% (1)
  • B
    3% (1)
  • D
    93% (27)

Why each option

The question describes an IDS evasion technique where a data packet is accepted by the IDS but rejected by the target host.

AEvasion attack

"Evasion attack" is a broad category encompassing various techniques to bypass an IDS, not a specific technique itself as described.

BFragmentation overlap attack

A fragmentation overlap attack involves sending overlapping IP fragments that cause the IDS and host to reassemble them differently.

CFragmentation overwrite attack

Fragmentation overwrite attack is a type of fragmentation attack where subsequent fragments overwrite previous ones, leading to different interpretations by the IDS and host.

DInsertion attackCorrect

An insertion attack involves sending packets that the Intrusion Detection System (IDS) will accept as legitimate traffic, but the actual target host will reject due to malformed headers, checksum errors, or out-of-sequence fragments. This discrepancy allows the attacker to "insert" data that the IDS sees but the host does not, potentially hiding malicious activity from the IDS.

Concept tested: IDS evasion - insertion attack

Topics

#IDS evasion#Insertion attack#Network security#Intrusion Detection Systems

Community Discussion

No community discussion yet for this question.

Full CSSLP Practice