GCIH · Question #501
Which of the following will best protect your network from being mapped by untrusted, external sources, while still allowing trusted sources to verify network connectivity with ping requests and…
The correct answer is D. Filter ICMP at the perimeter, allowing ICMP only from trusted sources. Filtering ICMP at the network perimeter and permitting it only from trusted sources prevents untrusted parties from using ICMP-based mapping while preserving legitimate ping functionality for trusted hosts.
Question
Which of the following will best protect your network from being mapped by untrusted, external sources, while still allowing trusted sources to verify network connectivity with ping requests and replies?
Options
- AUse settings on a network mapping tool to limit inbound ICMP and protect your network
- BEstablish an IDS on the DMZ to alert on all inbound ICMP requests
- CShut down ICMP and traceroute on your internal servers
- DFilter ICMP at the perimeter, allowing ICMP only from trusted sources
How the community answered
(52 responses)- A6% (3)
- B10% (5)
- C4% (2)
- D81% (42)
Why each option
Filtering ICMP at the network perimeter and permitting it only from trusted sources prevents untrusted parties from using ICMP-based mapping while preserving legitimate ping functionality for trusted hosts.
Network mapping tool settings control the outbound scanning behavior of that tool and do not restrict inbound ICMP packets arriving from untrusted external sources.
An IDS can detect and alert on ICMP traffic but does not block or filter it, so untrusted sources can still complete network mapping attempts unimpeded.
Disabling ICMP on internal servers does not prevent external mapping of the network perimeter and removes legitimate diagnostic capability for all sources including trusted ones.
Applying ICMP filtering at the perimeter firewall or router allows administrators to create access control rules that permit ICMP echo requests and replies only from trusted IP addresses or ranges. This stops untrusted external sources from using tools like ping sweeps or traceroute to map the network topology, while trusted sources retain the ability to verify connectivity. This approach satisfies both the security and operational requirements stated in the question.
Concept tested: Perimeter ICMP filtering to prevent network reconnaissance
Source: https://www.cisco.com/c/en/us/support/docs/ip/access-lists/13608-21.html
Topics
Community Discussion
No community discussion yet for this question.