Exam 312-50v13 Topic 1 Question 105 Discussion

Actual exam question for ECCouncil's 312-50v13 exam
Question #: 105
Topic #: 1
You perform a network scan using ICMP Echo Requests and observe that certain IP addresses do not return Echo Replies, while other network services remain functional. How should this situation be interpreted?

Suggested Answer: C Vote an answer

According to CEH v13 Network Scanning and Enumeration, ICMP Echo Requests (ping) are commonly filtered by firewalls and intrusion prevention systems to reduce network reconnaissance exposure. When ICMP Echo Replies are not returned but other services remain operational, the most likely explanation is ICMP filtering rather than host unavailability or compromise.
CEH v13 explicitly states that many organizations configure firewalls to block ICMP Echo Requests while allowing other ICMP types or higher-layer protocols. This practice helps prevent attackers from easily mapping live hosts during the reconnaissance phase.
The other options are incorrect because:
* Unused IPs would not necessarily have active services.
* A breach would typically present additional symptoms.
* Network congestion would affect multiple protocols, not just ICMP.
Thus, blocked ICMP is the correct interpretation.

by Theodore at May 12, 2026, 03:13 AM

Limited Time Offer

15%

Off

Get Premium 312-50v13 Questions as Interactive Self Test Engine or PDF

Comments

Chosen Answer:
This is a voting comment (?) , you can switch to a simple comment.
Switch to a voting comment New
Nick name: Submit Cancel
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
0
0
0
10