nerdexam
GIAC

GSLC · Question #100

IP blocking is a technique that prevents the connection between a server/website and certain IP addresses or ranges of addresses. Which of the following tools use this technique? Each correct answer r

The correct answer is C. Fail2Ban D. portsentry. Fail2Ban and portsentry are dedicated IP blocking tools that monitor host activity and automatically block offending IP addresses in response to detected attacks.

Security Operations & Incident Response Leadership

Question

IP blocking is a technique that prevents the connection between a server/website and certain IP addresses or ranges of addresses. Which of the following tools use this technique? Each correct answer represents a complete solution. Choose all that apply.

Options

  • ASSHGuard
  • Bnmap
  • CFail2Ban
  • Dportsentry
  • EOpenSSL

How the community answered

(27 responses)
  • B
    4% (1)
  • C
    93% (25)
  • E
    4% (1)

Why each option

Fail2Ban and portsentry are dedicated IP blocking tools that monitor host activity and automatically block offending IP addresses in response to detected attacks.

ASSHGuard

SSHGuard is an intrusion prevention system focused specifically on SSH and a few other services; it is not classified as a general-purpose IP blocking tool in the context of this exam.

Bnmap

nmap is a network scanning and host discovery tool used for reconnaissance and auditing - it has no capability to block or filter IP addresses.

CFail2BanCorrect

Fail2Ban parses system log files for repeated failed authentication attempts or other abuse patterns and dynamically updates firewall rules to block the source IP address, implementing IP blocking as its core function.

DportsentryCorrect

Portsentry monitors for active port scans against a host and responds automatically by blocking the scanning IP address via firewall rules or TCP wrappers, making IP blocking its primary defensive mechanism.

EOpenSSL

OpenSSL is a cryptographic library and SSL/TLS toolkit used for implementing encrypted communications and has no functionality related to IP address blocking.

Concept tested: IP blocking tools for host-based intrusion prevention

Source: https://www.fail2ban.org/wiki/index.php/Main_Page

Topics

#IP blocking#Fail2Ban#intrusion prevention#network security

Community Discussion

No community discussion yet for this question.

Full GSLC Practice