200-201 Question 118
Single answerA cybersecurity analyst discovers that attackers are using tunneling techniques to bypass the organization’s firewall and exfiltrate data. The attackers are encapsulating malicious traffic within legitimate protocols to avoid detection. Which of the following protocols is MOST commonly used for this type of tunneling attack?
- A
HTTP
- B
FTP
- C
ICMP
- D
SMTP
Show answer and explanation
Correct answer: C
Explanation
ICMP tunneling is a technique where attackers encapsulate data within ICMP packets, which are usually allowed through firewalls for diagnostic purposes like ping requests. This makes it a commonly exploited protocol for tunneling attacks as it can bypass certain security controls without raising immediate suspicion.
- A. Incorrect.
HTTP is a commonly used protocol for web traffic and can sometimes be abused for data exfiltration. However, it is not the most typical choice for tunneling attacks due to its visibility and frequent monitoring by security tools.
- B. Incorrect.
FTP is a protocol used for file transfers and is vulnerable to misuse. However, it is less likely to be used for covert tunneling compared to ICMP.
- C. Correct.
ICMP (Internet Control Message Protocol) is often used for tunneling attacks because it is typically allowed through firewalls for network troubleshooting purposes, making it less suspicious to security systems.
- D. Incorrect.
SMTP is a protocol for email communication. While it can be exploited for certain attacks, it is not the most commonly used protocol for tunneling attacks.