Study. uk . com
  1. Home
  2. All questions
  3. Question 264

CISSP study material · question 264 of 500

An attacker sends a packet whose header claims membership of an established connection, hoping to pass the firewall. Which two mechanisms does NIST SP 800-41 describe that defeat this? Choose two.

  1. Many firewalls reject packets whose TCP sequence numbers are out of order.
  2. The firewall rewrites the packet's source address before forwarding it.
  3. The firewall reassembles the packet's fragments before matching it.
  4. The firewall checks the packet against its state table before permitting it.
Show the answer

Answer: D. The firewall checks the packet against its state table before permitting it.
A. Many firewalls reject packets whose TCP sequence numbers are out of order.

The firewall checks the packet against its state table, and many enforce protocol state machines, rejecting packets whose sequence numbers fall out of order.

Source: NIST SP 800-41 Rev. 1 (NIST) — SP 800-41 Rev. 1 > 2.1.2 Stateful Inspection

Challenge yourself on this topic → Study as cards