Instant Access ISC.SSCP.v2022-06-29.q999 Actual Practice Test Engine for Free (Page 56)

Question 272

In the context of network enumeration by an outside attacker and possible Distributed Denial of Service (DDoS) attacks, which of the following firewall rules is not appropriate to protect an organization's internal network?

A.Allow echo reply outbound
B.Allow echo request outbound
C.Drop echo request inbound
D.Allow echo reply inbound

Correct Answer: A

Echo replies outbound should be dropped, not allowed. There is no reason for any internet users to send ICMP ECHO Request to your interal hosts from the internet. If they wish to find out if a service is available, they can use a browser to connect to your web server or simply send an email if they wish to test your mail service.
Echo replies outbound could be used as part of the SMURF amplification attack where someone will send ICMP echo requests to gateways broadcast addresses in order to amplify the request by X number of users sitting behind the gateway.
By allowing inbound echo requests and outbound echo replies, it makes it easier for attackers to learn about the internal network as well by performing a simply ping sweep. ICMP can also be used to find out which host has been up and running the longest which would indicates which patches are missing on the host if a critical patch required a reboot.
ICMP can also be use for DDoS attacks, so you should strictly limit what type of ICMP traffic would be allowed to flow through your firewall.
On top of all this, tools such as LOKI could be use as a client-server application to transfer files back and forward between the internat and some of your internal hosts. LOKI is a client/server program published in the online publication Phrack . This program is a working proof-of-concept to demonstrate that data can be transmitted somewhat secretly across a
network by hiding it in traffic that normally does not contain payloads. The example code
can tunnel the equivalent of a Unix RCMD/RSH session in either ICMP echo request (ping)
packets or UDP traffic to the DNS port. This is used as a back door into a Unix system after
root access has been compromised. Presence of LOKI on a system is evidence that the
system has been compromised in the past.
The outbound echo request and inbound echo reply allow internal users to verify
connectivity with external hosts.
The following answers are incorrect:
Allow echo request outbound The outbound echo request and inbound echo reply allow
internal users to verify connectivity with external hosts.
Drop echo request inbound There is no need for anyone on the internet to attempt pinging
your internal hosts.
Allow echo reply inbound The outbound echo request and inbound echo reply allow internal
users to verify connectivity with external hosts.
Reference(s) used for this question:
http://www.phrack.org/issues.html?issue=49&id=6
STREBE, Matthew and PERKINS, Charles, Firewalls 24seven, Sybex 2000, Chapter 10:
The Perfect Firewall.

Question 273

What algorithm has been selected as the AES algorithm, replacing the DES algorithm?

A.RC6
B.Twofish
C.Rijndael
D.Blowfish

Question 274

Which backup method is used if backup time is critical and tape space is at an extreme premium?

A.Incremental backup method.
B.Differential backup method.
C.Full backup method.
D.Tape backup method.

Question 275

Technical controls such as encryption and access control can be built into the operating system, be software applications, or can be supplemental hardware/software units. Such controls, also known as logical controls, represent which pairing?

A.Preventive/Administrative Pairing
B.Preventive/Technical Pairing
C.Preventive/Physical Pairing
D.Detective/Technical Pairing

Question 276

An alternative to using passwords for authentication in logical or technical access control is:

A.manage without passwords
B.biometrics
C.not there
D.use of them for physical access control

Question 272

Question 273

Question 274

Question 275

Question 276

Download PDF File