Study. uk . com
  1. Home
  2. All questions
  3. Question 259

CISSP study material · question 259 of 500

A network team wants to stop compromised internal hosts sending traffic with forged source addresses out to the internet. Which measure does NIST SP 800-41 describe?

  1. Stateful inspection with a shortened idle timeout on outbound sessions.
  2. Fragment reassembly on the outbound interface before forwarding.
  3. Egress filtering that permits only source addresses the organisation actually uses.
  4. Ingress filtering that blocks inbound traffic from private address ranges.
Show the answer

Answer: C. Egress filtering that permits only source addresses the organisation actually uses.

Filtering outgoing traffic is egress filtering; permitting only the organisation's own source addresses helps block spoofed traffic from leaking onto other networks.

Source: NIST SP 800-41 Rev. 1 (NIST) — SP 800-41 Rev. 1 > 2.1.1 Packet Filtering

Challenge yourself on this topic → Study as cards