A security analyst is reviewing the following output from an IPS:
Given this output, which of the following can be concluded? (Select two.)
A.
The source IP of the attack is coming from 250.19.18.22.
B.
The source IP of the attack is coming from 250.19.18.71.
C.
The attacker sent a malformed IGAP packet, triggering the alert.
D.
The attacker sent a malformed TCP packet, triggering the alert.
E.
The TTL value is outside of the expected range, triggering the alert.
Seems out of scope for security+
The TTL should be 1… does that mean pick E, or pick C?
0
1
I think its C coz TTL is not outside the range by itself, its still between 1-255. IGAP packet is malformed since its TTL value has been modified
2
0