Exam SY0-501 topic 1 question 823 discussion

Actual exam question from CompTIA's SY0-501

Question #: 823
Topic #: 1

An intruder sniffs network traffic and captures a packet of internal network transactions that add funds to a game card. The intruder pushes the same packet multiple times across the network, which increments the funds on the game card. Which of the following should a security administrator implement to BEST protect against this type of attack?

A. An IPS
B. A WAF
C. SSH
D. An IPSec VPN

Show Suggested Answer

Suggested Answer: D 🗳️

by Teza at Aug. 24, 2020, 12:50 p.m.

Comments

Submit Cancel

babati

Highly Voted 4 years, 11 months ago

Unlike SSL/TLS, IPSec operates at the network layer (layer 3) of the OSI model, so the protocol is not application dependent. IPSec can provide both confidentiality (by encrypting data packets) and integrity/anti-replay (by signing each packet). The main drawback is that it is quite processor intensive, adding an overhead to data communications. IPSec can be used to secure communications on local networks and as a remote access protocol.

upvoted 16 times

...

Teza

Highly Voted 4 years, 11 months ago

The question stated the attacker is an intruder and he is sniffing internal network, I was thinking the answer should be SSH

upvoted 6 times

jas26says

4 years, 10 months ago

i think you should review the whole material twice again.

upvoted 21 times

...

fonka

4 years ago

You use secure shell or ssh to access remote device or protect terminal command transactions

upvoted 1 times

...

JosePulickal

Most Recent 4 years, 7 months ago

I am not convinced by the answer. I think we could argue that it is probably the least-worst option or I could be missing something. I believe SSL VPN would have been a good answer - but that is not an option here. A. IPS : Not sure it is a good option in this context. B. WAF : WAF's do protect against session replay attacks if I am not wrong. C. SSH : Does not make sense in this context. D. IPSec VPN : Probably. Just because the question has keyword 'intruder sniffs network' but I feel does not fit well into the rest of the question. Anyways: I was not able to conclude it was D. I will probably just click this option and move on if I get this question.

upvoted 3 times

...