nerdexam
GIAC

GSLC · Question #200

You check the logs on several clients and find that there is traffic coming in on an odd port (port 1872). All clients have the Windows XP firewall turned on. What should you do to block this…

The correct answer is B. Check the exceptions in the firewall and unselect that port exception. If the Windows XP firewall is enabled yet traffic still arrives on an unexpected port, a firewall exception for that port is allowing it through and must be removed to block the traffic.

Security Operations & Incident Response Leadership

Question

You check the logs on several clients and find that there is traffic coming in on an odd port (port 1872). All clients have the Windows XP firewall turned on. What should you do to block this unwanted traffic?

Options

  • ATrace back that traffic and find its origin.
  • BCheck the exceptions in the firewall and unselect that port exception.
  • CPerform a virus scan to find the virus responsible for this traffic.
  • DShut down the service that connects to that port.

How the community answered

(36 responses)
  • A
    6% (2)
  • B
    81% (29)
  • C
    11% (4)
  • D
    3% (1)

Why each option

If the Windows XP firewall is enabled yet traffic still arrives on an unexpected port, a firewall exception for that port is allowing it through and must be removed to block the traffic.

ATrace back that traffic and find its origin.

Tracing traffic to its source identifies the origin but does not block the port, leaving the clients exposed during the investigation.

BCheck the exceptions in the firewall and unselect that port exception.Correct

The Windows XP firewall blocks all unsolicited inbound connections by default, so traffic reaching port 1872 while the firewall is active indicates a port exception has been manually added. Opening the firewall settings and unchecking or deleting that specific port exception will cause the firewall to drop the inbound traffic immediately, which is the direct and correct fix.

CPerform a virus scan to find the virus responsible for this traffic.

Running a virus scan may detect malware but does not close the firewall exception or stop inbound traffic on the port, so the exposure persists regardless of the scan result.

DShut down the service that connects to that port.

Stopping the local service listening on the port prevents the application from responding but does not remove the firewall exception, so inbound packets can still reach the machine.

Concept tested: Windows firewall exception management to block unexpected ports

Source: https://support.microsoft.com/en-us/topic/how-to-configure-windows-firewall-in-windows-xp-sp2-92a4b5d3-dd70-3e2e-3bc8-2a2e39e93943

Topics

#Windows firewall#firewall exceptions#port blocking#traffic management

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full GSLC Practice