GCIH · Question #152
You work as a Network Administrator for Net Perfect Inc. The company has a Windows-based network. The company uses Check Point SmartDefense to provide security to the network of the company. You use…
The correct answer is B. Code red worm D. User-defined worm. Limiting maximum HTTP response headers in Check Point SmartDefense blocks HTTP-propagating worms like Code Red and user-defined worms that rely on malformed or excessive HTTP header manipulation.
Question
You work as a Network Administrator for Net Perfect Inc. The company has a Windows-based network. The company uses Check Point SmartDefense to provide security to the network of the company. You use SmartDefense on the HTTP servers of the company to fix the limitation for the maximum number of response headers allowed. Which of the following attacks will be blocked by defining this limitation? Each correct answer represents a complete solution. Choose all that apply.
Options
- ALand attack
- BCode red worm
- CBackdoor attack
- DUser-defined worm
How the community answered
(34 responses)- A15% (5)
- B65% (22)
- C21% (7)
Why each option
Limiting maximum HTTP response headers in Check Point SmartDefense blocks HTTP-propagating worms like Code Red and user-defined worms that rely on malformed or excessive HTTP header manipulation.
A Land attack is a Layer 3/4 TCP/IP attack where the source and destination IP and port fields are set to the same values, causing the target to loop, and it is unrelated to HTTP response header count restrictions.
The Code Red worm propagates by sending crafted HTTP requests to Microsoft IIS servers and relies on specific patterns within HTTP traffic, and enforcing a response header limit in SmartDefense restricts the abnormal HTTP header structures the worm uses to spread between servers.
A backdoor attack involves installing covert remote access software or hidden entry points on a compromised system, a post-exploitation technique that is not mitigated by restricting HTTP response header counts.
User-defined worms that spread via HTTP channels exploit web server response processing by embedding propagation logic within HTTP headers or exploiting servers that accept excessive response headers, so capping the header count prevents this propagation vector.
Concept tested: Check Point SmartDefense HTTP header limits blocking worm propagation
Topics
Community Discussion
No community discussion yet for this question.