A network analyst runs Zeek and notices that the tunnel.log shows an IP-in-IP tunnel originating from an internal workstation. Why is this significant from a security perspective?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because unauthorized tunneling protocols from workstations — especially IP-in-IP — can indicate malware establishing covert channels to bypass security controls; workstations have no legitimate business reason to originate IP-in-IP tunnels. A is wrong because corporate VPN clients typically use SSL VPN (HTTPS-based) or IPsec, not raw IP-in-IP encapsulation.
Full explanation below image
Full Explanation
B is correct because unauthorized tunneling protocols from workstations — especially IP-in-IP — can indicate malware establishing covert channels to bypass security controls; workstations have no legitimate business reason to originate IP-in-IP tunnels. A is wrong because corporate VPN clients typically use SSL VPN (HTTPS-based) or IPsec, not raw IP-in-IP encapsulation. C is wrong because unauthorized tunnel.log entries from workstations should be treated as suspicious and investigated, not considered informational. D is wrong because 6in4 (IPv6 over IPv4) is a specific transition technology with defined use cases; arbitrary IP-in-IP from a workstation is not a standard transition mechanism.