100-160 Question 68
Select 3A company has noticed unusual activity on its network. After investigation, it was discovered that attackers used IP spoofing to bypass firewall rules and gain unauthorized access to internal systems. Which of the following measures can help mitigate this type of attack?
- A
Implement ingress filtering to verify the legitimacy of incoming IP addresses.
- B
Enable MAC address filtering on all network devices.
- C
Use private IP addresses for internal systems and employ Network Address Translation (NAT).
- D
Configure the firewall to block all traffic originating from external IP addresses.
- E
Enable logging and monitoring of all outgoing and incoming traffic.
Show answer and explanation
Correct answers: A, C, E
Explanation
IP spoofing is a technique where attackers forge the source IP address to bypass security measures and gain unauthorized access. Mitigating this requires verifying the authenticity of incoming IP addresses (ingress filtering), reducing the exposure of internal systems through NAT, and monitoring traffic for suspicious behavior. These measures collectively strengthen the network's defense against such attacks.
- A. Correct.
Ingress filtering helps prevent IP spoofing by verifying that incoming packets come from legitimate sources, reducing the risk of spoofed IPs bypassing security measures.
- B. Incorrect.
While MAC address filtering can add a layer of security, it is not effective against IP spoofing, as MAC addresses operate at a different layer of the OSI model and are not related to IP address verification.
- C. Correct.
Using private IP addresses with NAT ensures that internal systems are not directly exposed to the internet, reducing the attack surface and mitigating risks associated with spoofed external IPs.
- D. Incorrect.
Blocking all traffic from external IP addresses is not practical for most networks as it would disrupt legitimate communication and is not a specific countermeasure for IP spoofing.
- E. Correct.
Logging and monitoring traffic can help identify patterns of suspicious activity, including IP spoofing attempts, and assist in taking corrective actions promptly.