312-50 Question 269
Single answer▪ Evading FirewallsDuring an authorized internal assessment, you discover that a perimeter firewall allows outbound HTTPS (TCP 443) and DNS (UDP/TCP 53) but blocks direct outbound connections on most other ports. You need to validate whether a host inside the network can still establish a command-and-control style channel to an external system without using obviously blocked ports. Which approach is the MOST appropriate to test firewall evasion in this scenario while remaining consistent with common CEH techniques?
- A
Encapsulate traffic in an HTTPS tunnel over TCP 443 to blend with permitted outbound web traffic
- B
Send ICMP echo requests with a large payload because firewalls do not inspect ICMP
- C
Use ARP spoofing to route traffic through the firewall because ARP is not filtered at Layer 3
- D
Initiate an SMB session over TCP 445 and rely on packet fragmentation to bypass the firewall
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use a channel that the firewall already permits, such as HTTPS over TCP 443, and test whether encapsulated traffic can traverse egress controls. In practice, firewalls often make decisions based on port, protocol, state, and application inspection. If outbound 443 is allowed, an assessor should validate whether the device enforces only port-based rules or performs deeper inspection that would detect nonstandard use of HTTPS/TLS. This is a classic firewall evasion concept in CEH: using permitted protocols to carry traffic that would otherwise be blocked. By contrast, ICMP tunneling may work in some environments but is not guaranteed and the option includes a false claim about firewall inspection. ARP spoofing is unrelated to perimeter egress evasion because it operates on the local subnet. SMB over 445 is usually blocked externally, and fragmentation is not a dependable bypass against modern firewalls. This reasoning is consistent with common security best practices from firewall vendors and network security guidance emphasizing egress filtering, application-aware inspection, and protocol validation rather than simple port-based allow rules.
- A. Correct.
Correct. If outbound HTTPS is explicitly permitted, testing whether traffic can be tunneled over TCP 443 is a realistic firewall evasion technique. In authorized assessments, this commonly means using an HTTPS or TLS-based tunnel, or otherwise encapsulating traffic so it traverses a port and protocol the firewall already allows. This aligns with real-world attacker behavior and CEH objectives around using allowed channels to bypass port-based egress controls.
- B. Incorrect.
Incorrect. ICMP is sometimes allowed for diagnostics, but many firewalls and IDS/IPS devices inspect, rate-limit, or block ICMP tunneling patterns. The statement that firewalls do not inspect ICMP is false. While ICMP tunneling exists as a technique, it is less appropriate here than using an explicitly allowed service such as HTTPS, and the option is based on an inaccurate assumption.
- C. Incorrect.
Incorrect. ARP spoofing is a local network attack used to manipulate Layer 2 traffic within the same broadcast domain, typically for man-in-the-middle scenarios. It does not help a host evade a perimeter firewall for outbound Internet access in the described way. The misconception is confusing local subnet traffic manipulation with bypassing egress filtering at the network perimeter.
- D. Incorrect.
Incorrect. SMB over TCP 445 is commonly restricted at firewalls, especially for outbound Internet traffic, due to security risks. Packet fragmentation is also not a reliable or modern method for bypassing well-configured firewalls, since many devices perform reassembly or normalize fragmented traffic before filtering. This option combines two weak assumptions and is not the most appropriate test.