GSLC · Question #569
A security administrator suspects that an increase in the amount of TFTP traffic on the network is due to unauthorized file transfers, and wants to configure a firewall to block all TFTP traffic…
The correct answer is D. Deny UDP port 69. TFTP uses UDP port 69 exclusively, so denying UDP port 69 at the firewall is the correct way to block all TFTP traffic.
Question
A security administrator suspects that an increase in the amount of TFTP traffic on the network is due to unauthorized file transfers, and wants to configure a firewall to block all TFTP traffic. Which of the following would accomplish this task?
Options
- ADeny TCP port 68
- BDeny TCP port 69
- CDeny UDP port 68
- DDeny UDP port 69
How the community answered
(59 responses)- A2% (1)
- B5% (3)
- C2% (1)
- D92% (54)
Why each option
TFTP uses UDP port 69 exclusively, so denying UDP port 69 at the firewall is the correct way to block all TFTP traffic.
TCP port 68 is the DHCP client port used for dynamic IP address assignment, and has no association with TFTP whatsoever.
TFTP does not use TCP under any circumstance; it is a UDP-only protocol, so a rule denying TCP port 69 has zero effect on TFTP traffic.
UDP port 68 is the DHCP client port, not a TFTP port; blocking it would disrupt dynamic IP address acquisition, not file transfers.
TFTP is defined in RFC 1350 and operates solely over UDP on port 69, using its own lightweight sequencing instead of TCP's connection-oriented delivery. Denying UDP port 69 at the firewall drops all TFTP datagrams before any file transfer can be initiated or completed. No other port or protocol combination is involved in a standard TFTP session.
Concept tested: TFTP protocol port number and transport layer identification
Source: https://datatracker.ietf.org/doc/html/rfc1350
Topics
Community Discussion
No community discussion yet for this question.