Host Discovery with Strict TCP Firewall Filtering
Short answer
D Use a UDP Ping Scan to discover live hosts when strict TCP filtering blocks standard TCP and often ICMP discovery methods.
Question
Key Takeaways
The core trap is assuming standard ICMP or TCP methods work; the key insight is that 'strict TCP filtering' implies blocking SYN/ACK, making UDP the viable alternative for discovery.
This question addresses host discovery techniques when a firewall enforces strict TCP filtering. It establishes that UDP Ping Scan is the preferred method to bypass TCP-based restrictions and identify live hosts.
Common mistake: Many candidates choose C (TCP SYN Ping Scan) because it is stealthy and commonly used, but they fail to account for the specific constraint of 'strict TCP filtering' which blocks these packets.
Expert Analysis
Why the Answer Is Correct
The correct technique is D (UDP Ping Scan). The question explicitly states the network uses 'strict TCP filtering rules.' This means the firewall is actively dropping or rejecting TCP packets, including SYN requests. Since TCP and ICMP are blocked, the tester must use UDP. Sending UDP probes to closed ports elicits an ICMP Port Unreachable message, confirming the host is alive while potentially bypassing the strict TCP filter.
Why the Other Options Are Wrong
Option A (ICMP Timestamp) and Option B (ICMP ECHO) rely on ICMP, which is typically restricted in high-security environments alongside strict TCP filters. Option C (TCP SYN) is the most common host discovery method but fails here because the firewall specifically blocks TCP traffic. If the TCP filter is strict, SYN packets will be dropped, resulting in no response.
Community Comment Notes
The community consensus strongly favors D, with users noting that keywords like 'strict TCP filtering' rule out TCP and often ICMP options. One user noted that UDP can sometimes bypass restrictions where others fail. Another commenter correctly identified that since TCP is filtered, TCP-related scans are invalid choices.
Exam Strategy
Always look for negative constraints in the question stem. If a firewall is described as 'strictly filtering' a protocol, you must eliminate all options relying on that protocol. In this case, 'Strict TCP' eliminates A, B, and C, leaving UDP as the only logical choice.
Frequently Asked Questions
Why not use TCP SYN scan if it's stealthy?
Does UDP ping always work against firewalls?
Community Votes
100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 4 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 4
-
insaniunt 👍 5 Answered DD. UDP Ping Scan When dealing with strict TCP filtering rules on a firewall, a UDP Ping Scan can be an effective host discovery technique. Unlike ICMP or TCP SYN ping scans, UDP ping scans use UDP packets, which can sometimes bypass certain firewall restrictions.
-
7c4eac1 👍 1 Answered CSYN packets are often permitted for legitimate connection attempts, making it an effective way to discover hosts in environments with restricted ICMP and UDP traffic.
-
qtygbapjpesdayazko 👍 1 Answered DIs D. Key word "strict TCP filtering rules on its firewall". so can not be ICMP and TCP related scans.
-
agelbahri 👍 1 Answered Astrict TCP filtering rules on its firewall
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.