Study. uk . com
  1. Home
  2. All questions
  3. Question 265

CISSP study material · question 265 of 500

A firewall administrator configures the device to drop all fragmented packets, arguing fragments are only used in attacks. Which two objections does NIST SP 800-41 raise? Choose two.

  1. Tunnelling protocols that encapsulate packets routinely produce fragments, and blocking them is a common cause of interoperability trouble.
  2. Fragments cannot be dropped because the standards forbid it.
  3. Fragmentation has legitimate and necessary uses on the internet.
  4. Dropping fragments prevents the firewall from performing stateful inspection at all.
Show the answer

Answer: C. Fragmentation has legitimate and necessary uses on the internet.
A. Tunnelling protocols that encapsulate packets routinely produce fragments, and blocking them is a common cause of interoperability trouble.

Automatic blocking is not recommended: fragmentation has legitimate uses, and blocked fragments are a common cause of virtual private network interoperability trouble.

Source: NIST SP 800-41 Rev. 1 (NIST) — SP 800-41 Rev. 1 > 2.1.1 Packet Filtering

Challenge yourself on this topic → Study as cards