GCIH · Question #441
Out of the following, which is the most effective way to protect against rogue modems and the risk they introduce?
The correct answer is B. Enable egress firewall filtering. Rogue modems create unauthorized outbound dial-up connections that bypass perimeter defenses; egress firewall filtering is the most effective preventive control against the outbound communication they enable.
Question
Out of the following, which is the most effective way to protect against rogue modems and the risk they introduce?
Options
- AConduct regular war dialing scans
- BEnable egress firewall filtering
- CFilter modem lines at the firewall
- DDisable the Point to Point Protocol (PPP)
How the community answered
(27 responses)- A4% (1)
- B70% (19)
- C15% (4)
- D11% (3)
Why each option
Rogue modems create unauthorized outbound dial-up connections that bypass perimeter defenses; egress firewall filtering is the most effective preventive control against the outbound communication they enable.
War dialing is a detection technique used to discover active modem lines by scanning phone numbers, not a preventive control that stops rogue modems from being exploited.
Egress firewall filtering monitors and blocks unauthorized outbound traffic leaving the network, making it the most effective preventive control against rogue modems. Even if a rogue modem is physically present, egress filtering can detect and block the unauthorized outbound connections it attempts to establish, preventing data exfiltration and back-channel access. This is a proactive preventive measure rather than a reactive or detective one.
Dial-up modem connections use the public telephone network and bypass the corporate firewall entirely, making filtering modem lines at the firewall technically infeasible in standard architectures.
Disabling PPP is impractical to enforce across an enterprise and does not address the physical risk of unauthorized modem hardware being connected directly to workstations.
Concept tested: Rogue modem prevention using egress firewall filtering
Source: https://csrc.nist.gov/publications/detail/sp/800-41/rev-1/final
Topics
Community Discussion
No community discussion yet for this question.