Which Control Best Blocks Externally Crafted Malicious Packets?
Short answer
C An intrusion prevention system (IPS) inspects traffic inline and blocks externally crafted malicious packets before they reach the internal network.
Question
Key Takeaways
The question tests inline network inspection versus host- or access-based controls, and the trap is choosing a network allow list because it sounds absolute but cannot analyze crafted packet payloads.
This SY0-701 scenario asks which control is the most secure way to harden a network against externally crafted malicious packets. The page explains why an intrusion prevention system (IPS) is the correct answer (C) by inspecting and blocking malicious traffic inline before it reaches internal hosts.
Common mistake: Many candidates choose E, the network allow list, because it conceptually blocks all traffic except trusted sources; however, it does not inspect packet content and can be bypassed through allowed protocols or compromised trusted hosts.
Expert Analysis
Why the Answer Is Correct
An intrusion prevention system (IPS) is the only option that actively inspects packet payloads and can drop malicious traffic inline before it reaches internal systems. It can detect patterns, signatures, and anomalies associated with externally crafted packets, which matches the scenario's network-hardening goal. By placing the IPS at the perimeter or a chokepoint, the organization gets both detection and prevention without relying on each endpoint. The exam's key distinction here is that IPS provides network-level, inline enforcement against malicious packets, not just logging or access control. Therefore C is the most secure method in the given list.
Why the Other Options Are Wrong
A, anti-malware solutions, focus on endpoint malware execution and do not inspect network-crafted packets at the perimeter, so they leave the network path exposed. B, host-based firewalls, protect individual hosts but are not a centralized, network-wide inline inspection layer and depend on consistent host configuration. D, network access control (NAC), authenticates and authorizes devices before admission; it does not analyze packet content for crafted attacks. E, a network allow list, only permits trusted sources or services, but crafted malicious packets can originate from an allowed host, exploit an allowed protocol, or spoof a trusted address, so it is not the most secure control for this threat.
Community Comment Notes
The commenter 1f2b013 argued that an IPS works by "analyzing and filtering packets before they reach the internal network," which aligns with the inline prevention rationale. Pitrix supported the network allow list as blocking untrusted external traffic, but that view treats source filtering as equivalent to payload inspection, which the exam does not. Anyio similarly noted that an IPS "blocks them before they can reach the internal network," reinforcing why C beats the other options. The community majority and the scorer's suggested key both land on C, and the technical reasoning supports that verdict.
Official Reference
These links open the official vendor documentation in a new tab.
Exam Strategy
For SY0-701 network-hardening scenarios, identify the control that inspects traffic inline at the network boundary rather than on each endpoint. Eliminate anti-malware, host firewalls, NAC, and allow lists when the requirement is to block crafted packets, because none of them analyze packet content at the network chokepoint.
Frequently Asked Questions
Why is a network allow list not the most secure choice against crafted packets?
Does a host-based firewall block externally crafted malicious packets as well as an IPS?
Community Votes
75% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 3 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 3
-
1f2b013 👍 2 Answered CAn IPS provides comprehensive protection against malicious network traffic by analyzing and filtering packets before they reach the internal network.
-
Anyio 👍 1 Answered CC. Intrusion Prevention Systems (IPS) Explanation: An Intrusion Prevention System (IPS) actively monitors network traffic for suspicious patterns or malicious packets and blocks them before they can reach the internal network. IPS is specifically designed to detect and prevent externally crafted malicious packets, making it the most secure and effective solution for this scenario. Other Options: B. Host-based firewalls: While useful for protecting individual devices, they are not sufficient to secure the entire internal network from malicious packets. D. Network access control (NAC): NAC is focused on ensuring that only authorized devices can connect to the network but does not inspect or block malicious packets. E. Network allow list: This approach can restrict access to only known safe sources but is less dynamic and effective against crafted malicious packets compared to IPS.
-
Pitrix 👍 1 Answered EE. Network allow list Here’s why: • A network allow list (also known as a whitelist) ensures that only trusted sources or specific IP addresses are allowed to send traffic to the internal network. This approach effectively blocks all untrusted external traffic, which directly prevents malicious packets from entering the network in the first place.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All SY0-701 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SY0-701 Practice Test →