Question: A security analyst is reviewing the data portion acquired from the following command: tcpdump - lnvi icmp and src net 1 9 2 . 1

A security analyst is reviewing the data portion acquired from the following command:
tcpdump -lnvi icmp and src net 192.168.1.0/24 and dst net 0.0.0.0/0-w
output.pcap
The data portion of the packet capture shows the following:
The analyst suspects that a data exfiltration attack is occurring using a pattern in which the last
five digits are encoding sensitive information. Which of the following technologies and associated
rules should the analyst implement to stop this specific attack? (Choose two.)
A. Intrusion prevention system
B. Data loss prevention
C. sed -e 's/a-z.*0-9.*//g'
D. reject icmp any any <> any any (msg:"alert"; regex [a-z]{26}[0-9]{5})
E. Second-generation firewall
F. drop icmp from 192.168.1.0/24 to 0.0.0.0/0

Step by Step Solution

There are 3 Steps involved in it

1 Expert Approved Answer
Step: 1 Unlock blur-text-image
Question Has Been Solved by an Expert!

Get step-by-step solutions from verified subject matter experts

Step: 2 Unlock
Step: 3 Unlock

Students Have Also Explored These Related Databases Questions!