Study. uk . com
  1. Home
  2. All questions
  3. Question 271

CISSP study material · question 271 of 500

Which two fragmentation behaviours does NIST SP 800-41 identify as characteristic of attacks rather than normal traffic? Choose two.

  1. Sending fragments that are each smaller than the path maximum transmission unit.
  2. Sending fragments that overlap one another.
  3. Sending fragments that arrive out of order.
  4. Sending later fragments of a packet without ever sending the first fragment.
Show the answer

Answer: B. Sending fragments that overlap one another.
D. Sending later fragments of a packet without ever sending the first fragment.

SP 800-41 gives packets that should not exist in normal communication, such as fragments sent without the first fragment, or fragments that overlap each other, as examples of attack traffic.

Source: NIST SP 800-41 Rev. 1 (NIST) — SP 800-41 Rev. 1 > 2.1.1 Packet Filtering

Challenge yourself on this topic → Study as cards