hardMultiple ChoiceObjective-mapped
SSCP Practice Question: A helpdesk ticket reports that users can browse…
A helpdesk ticket reports that users can browse internal web servers but cannot access external websites. The IT team checks firewall logs and sees dropped packets with the DF flag set. What is the most likely cause?
⚠ Common exam trap
Watch out — candidates often assume the DF flag indicates a firewall rule explicitly blocking fragmented packets, rather than recognizing it as a symptom of missing ICMP feedback in the PMTUD process.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A firewall is blocking ICMP 'fragmentation needed' messages, preventing Path MTU Discovery.
The DF (Don't Fragment) flag being set in dropped packets indicates that packets are too large to traverse a network path without fragmentation, but the firewall is blocking the ICMP 'fragmentation needed' (Type 3, Code 4) messages. Without these ICMP messages, Path MTU Discovery (PMTUD) fails, causing the sending host to believe the packet was delivered when it was actually dropped. This prevents external websites from loading while internal servers (likely on the same MTU-friendly network) remain accessible.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The firewall is blocking outbound TCP port 80 and 443.
Why it's wrong here
If internal web servers work, outbound ports are likely allowed.
- ✓
A firewall is blocking ICMP 'fragmentation needed' messages, preventing Path MTU Discovery.
Why this is correct
This is a classic problem where DF packets are dropped because the firewall blocks ICMP type 3 code 4 messages.
- ✗
The DNS server is not resolving external domain names.
Why it's wrong here
DNS failure would prevent any name resolution, but internal browsing works.
- ✗
The switch port connecting the firewall is set to the wrong VLAN.
Why it's wrong here
This would affect all traffic, not just external.
Go deeper
Related to this question
About these practice questions
One of 920 original SSCP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.