Exam 312-49v10 topic 1 question 156 discussion

D < ... It works by sending out TCP or UDP packets with a TTL one [hop greater than the targeted gateway].

The Firewalk tool typically sends packets with varying TTL values, starting with a TTL of 1 and incrementing it with each probe. By monitoring the responses to these packets, Firewalk can infer the behavior of the target firewall. If a packet with a specific TTL value is allowed to pass through the firewall and reach its intended destination, Firewalk deduces that the corresponding port is open. If the packet is blocked or dropped by the firewall, Firewalk determines that the port is closed. --> Firewalk sets all packets with a TTL of one

I think the best answer is A. Firewalk is used to test the security of the firewall. If tested ports are closed or ICMP is droped by the firewall (which is a good security option) nothing will go trough the FW whatever the TTL. Another possibility is that the sniffer is placed too far from the target and the TTL is too low. So nothing reach the sniffer. But I prefere the A response. Any other suggestion is welcomed

This is not correct. Firewalk does not set TTL of all packets to one... it sets the TTL to one hop greater than the target gateway. The best answer is probably C, if this is the way the answers are actually worded on the exam question.