exam questions

Exam 350-701 All Questions

View all questions & answers for the 350-701 exam

Exam 350-701 topic 1 question 277 discussion

Actual exam question from Cisco's 350-701
Question #: 277
Topic #: 1
[All 350-701 Questions]

How is ICMP used as an exfiltration technique?

  • A. by flooding the destination host with unreachable packets
  • B. by sending large numbers of ICMP packets with a targeted hosts source IP address using an IP broadcast address
  • C. by encrypting the payload in an ICMP packet to carry out command and control tasks on a compromised host
  • D. by overwhelming a targeted host with ICMP echo-request packets
Show Suggested Answer Hide Answer
Suggested Answer: C 🗳️

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
sull3y
6 months, 2 weeks ago
Using ICMP packets to carry out command and control tasks on a compromised host is a common technique used in malware attacks. Malware can embed commands within the payload of ICMP packets, which are then sent to a command and control server controlled by the attacker. The server can then send responses back to the compromised host using ICMP packets, allowing the attacker to execute commands remotely without being detected. C:To make it more difficult for security personnel to detect the malicious traffic, attackers can encrypt the payload of the ICMP packets using various encryption algorithms. This makes it harder for network security devices to detect and identify the malicious traffic as it passes through the network.
upvoted 2 times
sull3y
6 months, 2 weeks ago
ANSWER IS C:Here are some reference links related to the use of ICMP in malware attacks: "Using ICMP for Command and Control" - SANS Institute: https://www.sans.org/reading-room/whitepapers/detection/icmp-command-control-34325 "Malware Using ICMP Tunneling" - Palo Alto Networks: https://unit42.paloaltonetworks.com/malware-using-icmp-tunneling/ "Using ICMP to Build Covert Channels in Malware" - Trend Micro: https://www.trendmicro.com/en_us/research/11/d/using-icmp-to-build-covert-channels-in-malware.html
upvoted 3 times
...
...
luisseijuro
8 months, 4 weeks ago
C is correct https://socfortress.medium.com/data-exfiltration-using-icmp-and-how-to-detect-it-69a799cca234
upvoted 1 times
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
Loading ...
exam
Someone Bought Contributor Access for:
SY0-701
London, 1 minute ago