Question

Why might a network administrator configure ingress filtering on the firewall to block ICMP packets while not doing the same on egress?

a. To prevent internal clients from targeting external hosts
b. To reduce the amount of traffic that is entering the network
c. To prevent the use of a ping flood as a Denial-of-Service technique
d. To prevent an outsider from mapping the network or detecting live hosts

Answer 1

A network administrator may use ingress filtering to block ICMP packets to prevent outsiders from mapping the network or detecting live hosts, which can help protect against reconnaissance activities that could lead to cyber attacks. Egress filtering for ICMP may not be as strict because internal ICMP traffic is less threatening and may be used for legitimate purposes.

Step-by-step explanation:

A network administrator might configure ingress filtering on a firewall to block ICMP packets to prevent an outsider from mapping the network or detecting live hosts. ICMP, the Internet Control Message Protocol, is commonly used for the operation of ping commands which can be utilized to discover hosts on a network and their state (live or down). By blocking incoming ICMP packets (ingress filtering), the network is protected against reconnaissance activities like network mapping, which could be a precursor to more serious cyber attacks.

While egress filtering (filtering outbound traffic) is also important, ICMP packets sent from inside the network to an external location are less likely to represent the same level of threat as unsolicited incoming packets. Therefore, blocking these can be viewed as less critical for maintaining network security, although it is still important to monitor and manage egress traffic based on an organization's security policy. Furthermore, ICMP echo requests originating from within the network could be used for legitimate diagnostic purposes, hence why egress filtering for ICMP may not be as stringent.