MENU
Which of the following Wireshark filters allows an administrator to detect SYN/FIN DDoS attempt on
the network?
Suggested Answer: A
Get Premium 312-38 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
According to NIST guidelines, the incident category that includes activities seeking to access or identify a federal agency computer, open ports, protocols, services, or any combination thereof for later exploitation is categorized as 'Scans/Probes/Attempted Access'. This category encompasses any unauthorized attempts to access systems, networks, or data, which may include scanning for vulnerabilities or probing to discover open ports and services.
39 comments · newest first
MA
Matthew
11 months ago
C looks interesting, but I don't think it applies here.
JA
Jackie
11 months ago
Wait, are we sure about A? Seems too simple.
WI
Willard
11 months ago
Definitely A, I've used it before for DDoS analysis.
CA
Casie
12 months ago
I think B is the right one, not A.
FE
Felicitas
12 months ago
A is the correct filter for SYN/FIN detection.
MA
Marjory
1 year ago
I remember that tcp.dstport==7 is related to echo requests, so it can't be the answer for a DDoS attempt.
CY
Cyril
1 year ago
I feel like tcp.flags==0x003 might be the right choice, but I’m a bit confused about the hexadecimal values.
TE
Teri
1 year ago
I practiced a similar question last week, and I think it was about identifying flags, but I can't recall the exact values.
SH
Shakira
1 year ago
I think I remember that SYN/FIN attacks involve specific TCP flag combinations, but I'm not sure which one it is.
FE
Felix
1 year ago
I'm confident that option A is the correct Wireshark filter to detect a SYN/FIN DDoS attack. The TCP flags 0x003 match the SYN/FIN pattern we discussed in class.
EL
Ellsworth
1 year ago
Okay, I've got this. The key is to look for the TCP flags that indicate a SYN/FIN DDoS attempt. I think option A is the right answer.
JO
Johna
1 year ago
Hmm, I'm a bit confused by the different TCP flag options. I'll need to review my notes on TCP flags and DDoS attacks to figure this out.
FR
Freeman
1 year ago
This looks like a tricky one. I'll need to think carefully about the TCP flags and how to detect a SYN/FIN DDoS attack.
AR
Aracelis
1 year ago
I'm not totally sure about this one. I'll need to double-check the TCP flag values and think through the DDoS detection logic. Gotta be careful on this exam question.
CA
Cathrine
1 year ago
Hmm, I'm a bit unsure here. I know we need to send the confirmation email, but I'm not sure if that should be part of the case configuration or a separate process. I'll have to think this through carefully.
RO
Robt
1 year ago
This is a good question to test our understanding of the Database Upgrade Assistant. I'll need to think through each option carefully and make sure I select the two correct situations where this tool can be used.
HA
Haydee
1 year ago
I wonder if the answer is 'All of the Above' and we're just supposed to find the most relevant one. Nah, probably not. I'll go with option A and hope I don't get a trick question.
RO
Rose
1 year ago
User 3: I agree, let's go with option A.
LE
Lenna
1 year ago
User 2: Yeah, that seems like the most relevant one.
MA
Marilynn
1 year ago
User 1: I think the answer is option A.
JE
Jenelle
1 year ago
User 3: I agree, let's go with option A and see if it's correct.
VA
Vallie
1 year ago
User 2: Yeah, that seems like the most relevant filter for detecting SYN/FIN DDoS attempts.
RO
Ronna
1 year ago
User 1: I think the answer is A) tcp.flags==0x003
AN
Anissa
2 years ago
Wow, these options are really something. I bet the person who wrote this question was having a bit too much fun with the hex values. I'm sticking with option A, though. Gotta keep it simple, you know?
SH
Shawnna
2 years ago
Ah, the good old tcp.dstport==7. Classic. But I don't think that's going to help me detect a SYN/FIN DDoS attack. I'll have to go with option A on this one.
ME
Merilyn
1 year ago
User 4: Definitely, tcp.flags==0x003 is the way to go for detecting that type of attack.
MA
Malinda
1 year ago
User 3: Yeah, tcp.flags==0x003 is the correct filter for detecting SYN/FIN DDoS.
VA
Vallie
1 year ago
User 2: I agree, I think option A (tcp.flags==0x003) is the right choice for detecting SYN/FIN DDoS.
NI
Nicolette
1 year ago
User 1: tcp.dstport==7 is a classic filter, but it won't help with SYN/FIN DDoS.
TR
Tracey
2 years ago
I'm not sure, but I think C) TCP.flags==0x300 could also be a possible filter to detect SYN/FIN DDoS attempts.
QU
Quentin
2 years ago
Hmm, option B looks interesting, but I'm not sure if tcp.flags==0X029 is the right way to go. I better double-check the Wireshark documentation just to be safe.
EU
Eun
2 years ago
TCP.flags==0x300? Really? That's not even a valid Wireshark filter. I think I'll go with option A - tcp.flags==0x003 to detect SYN/FIN DDoS attacks.
VE
Venita
1 year ago
I agree, TCP.flags==0x300 is not a valid Wireshark filter. Option A is the way to go.
MI
Mitzie
1 year ago
Option A - tcp.flags==0x003 is the correct filter for detecting SYN/FIN DDoS attacks.
GI
Gilma
2 years ago
I agree with Dannie, because SYN/FIN DDoS attacks involve specific TCP flags.
DA
Dannie
2 years ago
I think the answer is A) tcp.flags==0x003.
LI
Ligia
2 years ago
That makes sense, thanks for explaining. I'll reconsider my answer.
CH
Chauncey
2 years ago
I disagree, I believe the correct answer is C) TCP.flags==0x300 because it specifically looks for SYN/FIN flags.
LI
Ligia
2 years ago
I think the answer is A) tcp.flags==0x003.