GSEC · Question #112
GSEC Question #112: Real Exam Question with Answer & Explanation
The correct answer is B. B and C. Ingress filtering is a border security technique where routers/firewalls drop inbound packets whose source IP addresses are logically impossible or suspicious. If a packet arrives from the Internet claiming to originate from an internal (private) IP address, there are two plausib
Question
Options
- AA and B
- BB and C
- CB and D
- DA and D
Explanation
Ingress filtering is a border security technique where routers/firewalls drop inbound packets whose source IP addresses are logically impossible or suspicious. If a packet arrives from the Internet claiming to originate from an internal (private) IP address, there are two plausible explanations: (B) The packets may have been accidentally routed onto the Internet - internal traffic that leaked out and looped back; or (C) The packets may be deliberately spoofed by an attacker - a common technique in IP spoofing attacks where an attacker fakes an internal source address to impersonate a trusted host or bypass access controls. Option A (corruption) is incorrect because corruption would not consistently produce valid internal source addresses. Option D (excess fragmentation) is a separate concern unrelated to source address legitimacy. RFC 2827 (BCP 38) formalizes this ingress filtering best practice for exactly these reasons.
Community Discussion
No community discussion yet for this question.