nerdexam
GIAC

GCIH · Question #130

Adam works as a Network administrator for Umbrella Inc. He noticed that an ICMP ECHO requests is coming from some suspected outside sources. Adam suspects that some malicious hacker is trying to…

The correct answer is B. Network is still vulnerable to ping sweep attack. Blocking ICMP ECHO requests alone does not prevent all ping sweep techniques, as attackers can use TCP SYN, UDP, or other non-ICMP probes to discover live hosts.

Reconnaissance, Scanning, and Enumeration

Question

Adam works as a Network administrator for Umbrella Inc. He noticed that an ICMP ECHO requests is coming from some suspected outside sources. Adam suspects that some malicious hacker is trying to perform ping sweep attack on the network of the company. To stop this malicious activity, Adam blocks the ICMP ECHO request from any outside sources. What will be the effect of the action taken by Adam?

Options

  • ANetwork turns completely immune from the ping sweep attacks.
  • BNetwork is still vulnerable to ping sweep attack.
  • CNetwork is protected from the ping sweep attack until the next reboot of the server.
  • DNetwork is now vulnerable to Ping of death attack.

How the community answered

(62 responses)
  • A
    6% (4)
  • B
    79% (49)
  • C
    11% (7)
  • D
    3% (2)

Why each option

Blocking ICMP ECHO requests alone does not prevent all ping sweep techniques, as attackers can use TCP SYN, UDP, or other non-ICMP probes to discover live hosts.

ANetwork turns completely immune from the ping sweep attacks.

The network is not completely immune because ICMP is only one of several protocols used for host discovery; TCP and UDP-based sweep methods remain unaffected.

BNetwork is still vulnerable to ping sweep attack.Correct

Tools like Nmap can perform host discovery using TCP SYN packets to common ports (e.g., port 80 or 443), UDP probes, or ARP requests on local segments - none of which are blocked by an ICMP ECHO filter. This means the network remains discoverable and vulnerable to ping sweep variants that bypass ICMP restrictions.

CNetwork is protected from the ping sweep attack until the next reboot of the server.

Network filtering rules are persistent across reboots; the vulnerability exists continuously because non-ICMP sweep techniques are always available to an attacker.

DNetwork is now vulnerable to Ping of death attack.

Blocking ICMP ECHO actually reduces exposure to ping of death attacks (which exploit oversized ICMP packets), not increases it - this choice inverts the causal relationship.

Concept tested: ICMP filtering limitations against ping sweep attacks

Source: https://nmap.org/book/man-host-discovery.html

Topics

#ping sweep#ICMP filtering#network reconnaissance#countermeasure effectiveness

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full GCIH Practice