Answer B:
10.20.30.40 and 192.168.1.10 are both private IP addresses, which are used for internal networks. Since both IP's are private addresses, its not really exfiltrating data. Line 2 and 3 is what you want to be looking at. The request is Length 15, but ABCDEFJHIJ is only 10 CHARs in length, but you can see the reply is giving additional information, based on the length. Thats why the answer is B. If the request IP was coming from a publicly routable IP address, then the answer would be C.
I asked ChatGPT what an ICMP tunneling request looks like and this is what it said
Sure, here's an example log of a hypothetical ICMP tunneling echo request and reply:
ICMP Request Log:
Date/Time: 2022-09-01 10:15:20
Source IP: 192.168.1.10
Destination IP: 8.8.8.8
Protocol: ICMP
Type: Echo Request
Data: ABCDEFGHIJKLMNOPQRSTUVWXYZ
After considering points of other's comments, I'm still answering C.
Ref: https://blog.apnic.net/2022/03/31/how-to-detect-and-prevent-common-data-exfiltration-attacks/
Not A - no spoofing takes place and actual traffic for source and destination is seen in the capture
Not B - I never encountered information leak from memory making "network" actions. However, as for the output, even on the first line " ICMP ECHO REQUEST", the source already has the data ABCDEFGHIJK, surely this is not a leak from the destination (10.20.30.40)
Not D - not relevant to the output log.
After reviewing again, I think answer B is the only one that makes sense. The ICMP response from 10.20.30.40 is corrupted, so it's possible that a memory leak on that host might trigger that.
Agree. I see another response is stating this is Data Exfil possibly using ICMP Tunneling. However, ICMP tunneling is not commonly used and when it is used, it is deployed using special tools and is not done using the ping command.
Changed my mind, since this is actually the response that is showing corruption...so B is probably correct.
upvoted 1 times
...
...
...
...
This section is not available anymore. Please use the main Exam Page.CS0-002 Exam Questions
Log in to ExamTopics
Sign in:
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
Snkrsnaker1
Highly Voted 2 years, 2 months agonawaf702
Most Recent 1 year, 9 months agonovolyus
1 year, 7 months agormwilsn
2 years, 3 months agoCookieman
2 years, 3 months agokhrid4
2 years, 3 months agoCookieman
2 years, 3 months agoOnA_Mule
2 years, 3 months ago2Fish
2 years, 3 months agoKashim
2 years, 3 months agotalosDevbot
2 years, 4 months agoKashim
2 years, 3 months agoOnA_Mule
2 years, 3 months agoOnA_Mule
2 years, 3 months ago