SY0-301 · Question #419
The security administrator at ABC company received the following log information from an external party: 10:45:01 EST, SRC 10.4.3.7:3056, DST 8.4.2.1:80, ALERT, Directory traversal 10:45:02 EST, SRC…
The correct answer is D. ABC company uses PAT. ABC company uses PAT (Port Address Translation) (D), which maps all internal private IP addresses to a single public IP address, differentiating connections only by port number. The external party sees all attacks originating from abc-company.com's single public IP. When the…
Question
The security administrator at ABC company received the following log information from an external party:
10:45:01 EST, SRC 10.4.3.7:3056, DST 8.4.2.1:80, ALERT, Directory traversal 10:45:02 EST, SRC 10.4.3.7:3057, DST 8.4.2.1:80, ALERT, Account brute force 10:45:03 EST, SRC 10.4.3.7:3058, DST 8.4.2.1:80, ALERT, Port scan The external party is reporting attacks coming from abc-company.com. Which of the following is the reason the ABC company's security administrator is unable to determine the origin of the attack?
Options
- AA NIDS was used in place of a NIPS.
- BThe log is not in UTC.
- CThe external party uses a firewall.
- DABC company uses PAT.
How the community answered
(57 responses)- A5% (3)
- B9% (5)
- C18% (10)
- D68% (39)
Explanation
ABC company uses PAT (Port Address Translation) (D), which maps all internal private IP addresses to a single public IP address, differentiating connections only by port number. The external party sees all attacks originating from abc-company.com's single public IP. When the security administrator tries to trace the attack, they cannot identify which specific internal host (10.4.3.7 is a private RFC 1918 address not visible externally) initiated the connections because PAT aggregates all outbound traffic behind one external IP. Without reviewing NAT translation logs correlated to the exact timestamps and port numbers, the internal source is indeterminate. The time zone (UTC vs EST) would be irrelevant to source identification, and NIDS vs NIPS would not affect IP traceability.
Topics
Community Discussion
No community discussion yet for this question.