312-50 Question 80
Single answer▪ Network Scanning CountermeasuresA company discovers that external attackers are repeatedly using tools such as Nmap to identify exposed services on its Internet-facing subnet. The security team wants to reduce the usefulness of port-scanning results without breaking legitimate public services such as HTTPS and email. Which countermeasure would be the MOST effective and practical to implement first?
- A
Configure perimeter firewalls and ACLs to allow only required public ports and drop or reject probes to all unnecessary ports
- B
Disable DNS across the organization so attackers cannot resolve hostnames before scanning
- C
Force all internal hosts to respond to ICMP echo requests so scans finish faster and generate fewer retries
- D
Enable banner-grabbing on public services so administrators can better track which ports are being scanned
Show answer and explanation
Correct answer: A
Explanation
For network scanning countermeasures, the most effective first action is to minimize externally reachable services through firewall rules, router ACLs, and host-based filtering. This follows the principle of least functionality and reduces both the number of visible ports and the opportunities for follow-on exploitation. In practice, organizations should expose only required public services, segment systems appropriately, and monitor for reconnaissance using IDS/IPS, SIEM correlation, and firewall logs. Additional supporting measures can include rate limiting, tarpitting in some environments, disabling unnecessary services, and limiting service banners. Guidance from common hardening standards and vendor documentation, such as NIST recommendations on reducing attack surface and firewall best practices from major network/security vendors, consistently supports restricting unnecessary inbound access as a primary control.
- A. Correct.
Correct. Tight ingress filtering at the perimeter is the most practical and effective first step. By allowing only business-required services such as TCP 443 for HTTPS or required mail ports, and denying all unnecessary inbound traffic, the organization reduces the attack surface and limits the information a scan can reveal. This is a standard network hardening measure and a primary countermeasure against reconnaissance through port scanning.
- B. Incorrect.
Incorrect. Disabling DNS is neither practical nor an effective port-scanning countermeasure. Attackers can scan IP ranges directly without resolving names, and disabling DNS would disrupt normal business operations. The misconception is that name resolution is required for scanning; in reality, tools like Nmap can enumerate hosts and ports using IP addresses alone.
- C. Incorrect.
Incorrect. Allowing all internal hosts to answer ICMP echo requests does not reduce scanning risk; it typically makes host discovery easier. While ICMP policy should be tuned carefully, broadly enabling echo responses helps attackers identify live systems more efficiently. The misconception is that faster scans somehow reduce exposure, when in fact they improve attacker visibility.
- D. Incorrect.
Incorrect. Banner-grabbing exposes more service information, such as software versions and server types, which can help attackers prioritize exploits. Good defensive practice is usually to minimize unnecessary banners, not increase them. Administrators can use logging, IDS/IPS, and flow monitoring to track scans without making services more informative to attackers.