Question: A security analyst is reviewing the data portion acquired from the following command: tcpdump - lnvi icmp and src net 1 9 2 . 1
A security analyst is reviewing the data portion acquired from the following command:
tcpdump lnvi icmp and src net and dst net w
output.pcap
The data portion of the packet capture shows the following:
The analyst suspects that a data exfiltration attack is occurring using a pattern in which the last
five digits are encoding sensitive information. Which of the following technologies and associated
rules should the analyst implement to stop this specific attack? Choose two.
A Intrusion prevention system
B Data loss prevention
C sed e sazg
D reject icmp any any any any msg:"alert"; regex az
E Secondgeneration firewall
F drop icmp from to
Step by Step Solution
There are 3 Steps involved in it
1 Expert Approved Answer
Step: 1 Unlock
Question Has Been Solved by an Expert!
Get step-by-step solutions from verified subject matter experts
Step: 2 Unlock
Step: 3 Unlock
