Which technique limits the impact by denying traffic with spoofed addresses?

Which technique limits the impact by denying traffic with spoofed addresses?

• A. Traffic Pattern Analysis
• B. RFC 3704 Filtering
• C. Cisco IPS Source IP Reputation Filtering
• D. Event Log Analysis

Answer: (B)

Ingress filtering described in RFC 3704 blocks packets at the network edge if their source addresses don’t belong on the interface they’re entering from. By denying traffic with spoofed source addresses, this technique directly reduces the ability of attackers to use spoofed traffic—such as in reflection or amplification attacks—to impact a network. In practice, routers apply access control lists or anti-spoofing features (like URPF) to ensure inbound packets have legitimate source addresses for that path, stopping the spoofed traffic before it can cause harm. Other options don’t target spoofed sources at the boundary in the same direct way: traffic pattern analysis looks for unusual behavior to flag anomalies after the fact, event log analysis examines logs to detect incidents post hoc, and Cisco IPS source IP reputation filtering bases decisions on known bad IPs rather than validating that the source address is legitimate for the interface.

Ingress filtering described in RFC 3704 blocks packets at the network edge if their source addresses don’t belong on the interface they’re entering from. By denying traffic with spoofed source addresses, this technique directly reduces the ability of attackers to use spoofed traffic—such as in reflection or amplification attacks—to impact a network. In practice, routers apply access control lists or anti-spoofing features (like URPF) to ensure inbound packets have legitimate source addresses for that path, stopping the spoofed traffic before it can cause harm.

Other options don’t target spoofed sources at the boundary in the same direct way: traffic pattern analysis looks for unusual behavior to flag anomalies after the fact, event log analysis examines logs to detect incidents post hoc, and Cisco IPS source IP reputation filtering bases decisions on known bad IPs rather than validating that the source address is legitimate for the interface.