GSLC · Question #100
IP blocking is a technique that prevents the connection between a server/website and certain IP addresses or ranges of addresses. Which of the following tools use this technique? Each correct answer r
The correct answer is C. Fail2Ban D. portsentry. Fail2Ban and portsentry are dedicated IP blocking tools that monitor host activity and automatically block offending IP addresses in response to detected attacks.
Question
IP blocking is a technique that prevents the connection between a server/website and certain IP addresses or ranges of addresses. Which of the following tools use this technique? Each correct answer represents a complete solution. Choose all that apply.
Options
- ASSHGuard
- Bnmap
- CFail2Ban
- Dportsentry
- EOpenSSL
How the community answered
(27 responses)- B4% (1)
- C93% (25)
- E4% (1)
Why each option
Fail2Ban and portsentry are dedicated IP blocking tools that monitor host activity and automatically block offending IP addresses in response to detected attacks.
SSHGuard is an intrusion prevention system focused specifically on SSH and a few other services; it is not classified as a general-purpose IP blocking tool in the context of this exam.
nmap is a network scanning and host discovery tool used for reconnaissance and auditing - it has no capability to block or filter IP addresses.
Fail2Ban parses system log files for repeated failed authentication attempts or other abuse patterns and dynamically updates firewall rules to block the source IP address, implementing IP blocking as its core function.
Portsentry monitors for active port scans against a host and responds automatically by blocking the scanning IP address via firewall rules or TCP wrappers, making IP blocking its primary defensive mechanism.
OpenSSL is a cryptographic library and SSL/TLS toolkit used for implementing encrypted communications and has no functionality related to IP address blocking.
Concept tested: IP blocking tools for host-based intrusion prevention
Source: https://www.fail2ban.org/wiki/index.php/Main_Page
Topics
Community Discussion
No community discussion yet for this question.