mediumMultiple ChoiceObjective-mapped
CISSP Practice Question: A security team is reviewing firewall logs and…
A security team is reviewing firewall logs and sees many dropped packets from an external IP. What type of attack is most likely?
⚠ Common exam trap
A common mix-up: candidates confuse port scanning with a denial-of-service (DoS) attack, but port scanning is reconnaissance, not resource exhaustion, and the key clue is the pattern of dropped packets to multiple ports from a single IP.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Port scanning
Port scanning is the most likely attack because it involves an external IP sending packets to multiple ports on a target system to identify open services. Firewalls log these as dropped packets when they block unsolicited inbound traffic to closed or filtered ports, which is a common signature of reconnaissance activity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Man-in-the-middle
Why it's wrong here
A Man-in-the-Middle (MITM) attack involves an attacker secretly intercepting and relaying communication between two parties, often without either party's knowledge. This type of attack typically manifests as unusual traffic patterns, certificate warnings, or session hijacking, rather than a high volume of dropped packets by a firewall. Firewall logs showing dropped packets usually indicate connection attempts that are explicitly denied by rules or fail to establish, not successful interception of legitimate traffic.
- ✓
Port scanning
Why this is correct
Port scanning involves an attacker systematically probing a target system's ports to discover which services are listening or open. When a scanner attempts to connect to numerous closed or filtered ports, the firewall will log these connection attempts as dropped packets, as it denies access or the target service does not respond. A high volume of such drops across various ports is a strong indicator of an adversary performing reconnaissance.
- ✗
SQL injection
Why it's wrong here
SQL injection is an application-layer attack that exploits vulnerabilities in web applications to manipulate backend databases through malicious SQL queries. This attack typically occurs over established HTTP/S connections, where the firewall has already permitted the traffic based on its rules. Therefore, SQL injection attacks would not primarily manifest as a high volume of dropped packets in firewall logs, but rather as suspicious application-level requests or database errors.
- ✗
Phishing
Why it's wrong here
Phishing is a social engineering technique where attackers attempt to trick individuals into revealing sensitive information or performing actions, often through deceptive emails or websites. While phishing can lead to subsequent malware infections or credential theft, the initial act of phishing itself does not directly generate a large number of dropped packets in firewall logs. Firewall logs primarily reflect network connection attempts and policy enforcement, not user interaction with deceptive content.
Visual reference
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Firewall
A firewall is a network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules to protect trusted internal networks from untrusted external networks.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
One of 747 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.