Discuss GIAC GCIA Exam Topic 3 Question 85

Adam works as a Security Administrator for Umbrella Inc. A project has been assigned to him to secure access to the network of the company from all possible entry points. He segmented the network into several subnets and installed firewalls all over the network. He has placed very stringent rules on all the firewalls, blocking everything in and out except ports that must be used.

He does need to have port 80 open since his company hosts a website that must be accessed from the Internet. Adam is still worried about programs like Hping2 that can get into a network through covert channels.

Which of the following is the most effective way to protect the network of the company from an attacker using Hping2 to scan his internal network?

ABlock ICMP type 13 messages

BBlock all outgoing traffic on port 21

CBlock all outgoing traffic on port 53

DBlock ICMP type 3 messages

Suggested Answer: A

Get Premium GCIA Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

15 comments · newest first

Graham 1 month ago

I’d stick with A. It’s about minimizing exposure to potential threats.

Curt 1 month ago

Yeah, port 21 is for FTP. Not related to Hping2 scanning.

Kris 1 month ago

I feel like blocking outgoing traffic on port 21 is irrelevant here.

Xochitl 2 months ago

True, but Hping2 uses different methods. A is more targeted.

Coleen 2 months ago

I agree, but what about option D? Blocking ICMP type 3 could also prevent certain types of scans.

Venita 2 months ago

I think option A is the best choice. Blocking ICMP type 13 can help reduce information leakage.

Salena 2 months ago

Port 53 is crucial for DNS, blocking it might cause issues!

Clorinda 2 months ago

Wait, can Hping2 really bypass firewalls like that?

Shawna 2 months ago

Definitely agree with blocking ICMP type 3, it makes sense.

Veronica 3 months ago

I think blocking port 21 is overkill for this situation.

Marguerita 3 months ago

Blocking ICMP type 13 is a good move!

James 3 months ago

I’m leaning towards blocking ICMP type 3 messages, but I wish I had more clarity on how that specifically counters Hping2.

Corinne 3 months ago

This question reminds me of a practice exam where we had to secure a network against similar tools. I feel like blocking ICMP type 13 could be a good move.

Melodie 3 months ago

I think blocking ICMP type 3 could help, but I’m not entirely confident if that’s the best option for preventing scans.

Goldie 4 months ago

I remember we discussed how Hping2 can manipulate packets, but I'm not sure which ICMP types are most relevant here.

GIAC GCIA Exam - Topic 3 Question 85 Discussion