200-201 Question 290
Single answerA cybersecurity analyst is investigating unusual network activity within their organization. They notice a high volume of ICMP echo requests and replies between two hosts during a short timeframe. What is the most likely reason for this activity?
- A
A legitimate network diagnostic operation, such as a ping test, is being performed.
- B
A Denial of Service (DoS) attack leveraging ICMP traffic is being executed.
- C
A network routing protocol is malfunctioning and causing excessive ICMP traffic.
- D
A legitimate file transfer process is utilizing ICMP for data transmission.
Show answer and explanation
Correct answer: B
Explanation
ICMP echo requests and replies are used for network diagnostics, such as the 'ping' command, but a high volume in a short timeframe typically indicates malicious activity, such as a Ping Flood attack. This type of DoS attack attempts to overwhelm the target by flooding it with ICMP packets, making it the most likely explanation in this scenario.
- A. Incorrect.
While ICMP echo requests and replies are used for diagnostic purposes, the high volume of traffic in a short time is not typical of legitimate troubleshooting.
- B. Correct.
A high volume of ICMP echo requests and replies in a short timeframe is a common indication of a DoS attack, such as a Ping Flood, aiming to exhaust network resources.
- C. Incorrect.
Network routing protocols do not rely on ICMP echo requests/replies for their operations, so this explanation is unlikely.
- D. Incorrect.
ICMP is not designed for carrying payloads or transferring files; it is primarily a diagnostic and error-reporting protocol.