nerdexam
GIAC

GCFA · Question #129

John works as a professional Ethical Hacker. He has been assigned the project of testing the following result: Considering the above traceroute result, which of the following statements can be true?…

The correct answer is A. While tracerouting, John's network connection has become slow. B. Some router along the path is down. C. The We-are-secure server is using a packet filtering firewall. Traceroute timeouts or asterisks at hops can indicate multiple conditions including network slowness, downed routers, or firewall packet filtering blocking ICMP probes.

Threat Hunting & Timeline Analysis

Question

John works as a professional Ethical Hacker. He has been assigned the project of testing the following result:

Considering the above traceroute result, which of the following statements can be true? Each correct answer represents a complete solution. Choose all that apply.

Exhibit

GCFA question #129 exhibit

Options

  • AWhile tracerouting, John's network connection has become slow.
  • BSome router along the path is down.
  • CThe We-are-secure server is using a packet filtering firewall.
  • DThe IP address of the We-are-secure server is not valid.

How the community answered

(21 responses)
  • A
    76% (16)
  • D
    24% (5)

Why each option

Traceroute timeouts or asterisks at hops can indicate multiple conditions including network slowness, downed routers, or firewall packet filtering blocking ICMP probes.

AWhile tracerouting, John's network connection has become slow.Correct

When a traceroute shows delayed or missing responses, it can indicate that the network connection has become slow, causing probe packets to time out before receiving a reply.

BSome router along the path is down.Correct

Asterisks or missing hops in a traceroute output often indicate that a router along the path is unreachable or down, preventing ICMP TTL-exceeded messages from returning.

CThe We-are-secure server is using a packet filtering firewall.Correct

A packet filtering firewall on the destination server can silently drop ICMP or UDP probe packets, causing the final hops to appear as timeouts while earlier hops respond normally.

DThe IP address of the We-are-secure server is not valid.

An invalid IP address would cause the traceroute to fail immediately at the DNS or ARP resolution stage, not produce a partial hop trail with asterisks at specific points.

Concept tested: Traceroute output interpretation and network troubleshooting

Source: https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/tracert

Topics

#traceroute analysis#packet filtering firewall#network path analysis#firewall detection

Community Discussion

No community discussion yet for this question.

Full GCFA Practice