CSSLP · Question #260
In which of the following IDS evasion attacks does an attacker send a data packet such that IDS accepts the data packet but the host computer rejects it?
The correct answer is D. Insertion attack. The question describes an IDS evasion technique where a data packet is accepted by the IDS but rejected by the target host.
Question
In which of the following IDS evasion attacks does an attacker send a data packet such that IDS accepts the data packet but the host computer rejects it?
Options
- AEvasion attack
- BFragmentation overlap attack
- CFragmentation overwrite attack
- DInsertion attack
How the community answered
(29 responses)- A3% (1)
- B3% (1)
- D93% (27)
Why each option
The question describes an IDS evasion technique where a data packet is accepted by the IDS but rejected by the target host.
"Evasion attack" is a broad category encompassing various techniques to bypass an IDS, not a specific technique itself as described.
A fragmentation overlap attack involves sending overlapping IP fragments that cause the IDS and host to reassemble them differently.
Fragmentation overwrite attack is a type of fragmentation attack where subsequent fragments overwrite previous ones, leading to different interpretations by the IDS and host.
An insertion attack involves sending packets that the Intrusion Detection System (IDS) will accept as legitimate traffic, but the actual target host will reject due to malformed headers, checksum errors, or out-of-sequence fragments. This discrepancy allows the attacker to "insert" data that the IDS sees but the host does not, potentially hiding malicious activity from the IDS.
Concept tested: IDS evasion - insertion attack
Topics
Community Discussion
No community discussion yet for this question.