200-201 Question 289
Single answerA cybersecurity analyst is monitoring traffic on the network and notices a significant number of ICMP Echo Request packets originating from a single external IP address and targeting multiple internal hosts. What could this activity indicate?
- A
A legitimate network diagnostic operation using ICMP
- B
A Distributed Denial of Service (DDoS) attack using ICMP
- C
A reconnaissance scan attempting to map active hosts in the network
- D
A misconfigured internal device sending ICMP packets
Show answer and explanation
Correct answer: C
Explanation
The pattern of ICMP Echo Requests originating from a single external IP address and targeting multiple internal hosts is indicative of a reconnaissance scan. Attackers commonly use ICMP, such as 'ping sweeps,' to identify active hosts on a network. This is a typical precursor to further attacks as the attacker gathers information about the network.
- A. Incorrect.
While ICMP Echo Requests are used for legitimate diagnostics, such as pinging a host, the scenario describes a suspicious pattern where multiple internal hosts are being targeted, which is not typical for legitimate diagnostics.
- B. Incorrect.
A DDoS attack involves multiple attackers targeting a single victim. In this case, the traffic originates from a single external IP address targeting multiple internal hosts, which does not match the characteristics of a DDoS attack.
- C. Correct.
This activity is consistent with reconnaissance scanning. An attacker may use ICMP Echo Requests to identify live hosts on the internal network as part of their attempt to map the network.
- D. Incorrect.
A misconfigured device could generate ICMP packets, but the described traffic originates from an external IP address rather than an internal one, making this explanation unlikely.