200-201 Question 282
Single answerYou are a cybersecurity analyst tasked with investigating a potential network breach. You notice a suspicious IPv4 address, 192.168.1.200, attempting to communicate with an internal server. After consulting your organization's network diagram, you determine that the network uses the subnet mask 255.255.255.0. What is the most likely reason this address is flagged as suspicious?
- A
The IP address belongs to a public range and should not appear in the internal network.
- B
The IP address is not within the expected subnet range of 192.168.1.0/24.
- C
The IP address is reserved for broadcast traffic and should not appear in communication logs.
- D
The IP address is within the private range but could still be spoofed for malicious purposes.
Show answer and explanation
Correct answer: D
Explanation
The IP address 192.168.1.200 is valid and falls within the private subnet range 192.168.1.0/24 with a mask of 255.255.255.0. However, attackers can spoof private IP addresses to disguise their malicious activity. It is crucial to investigate further to determine if the communication attempt is legitimate or malicious.
- A. Incorrect.
Incorrect. 192.168.1.200 is part of the private IPv4 address space, so it is not a public address.
- B. Incorrect.
Incorrect. The address 192.168.1.200 is within the subnet range of 192.168.1.0/24, given the subnet mask 255.255.255.0.
- C. Incorrect.
Incorrect. The broadcast address for this subnet would be 192.168.1.255, not 192.168.1.200.
- D. Correct.
Correct. Although 192.168.1.200 is a valid private IP address within the subnet, it could still be used by an attacker through IP spoofing to appear legitimate.