Which statement about ICMP tunneling is true?

• A. It is easily detected and blocked by default on most networks.
• B. It cannot carry binary data.
• C. It relies on standard ICMP error messages for tunneling.
• D. It uses ICMP packets to carry hidden data.

Answer: (D)

ICMP tunneling hides data by placing it in the payload of ICMP packets and sending that data between hosts. This means the data isn’t in the usual network payload of a web or application protocol, but encoded inside ICMP messages themselves—often using echo requests and replies—to form a covert channel.

That’s why the statement that ICMP packets carry hidden data is true: the packets themselves are repurposed as a transport medium for the payload, outside normal application traffic. It’s not about using ICMP error messages specifically, and it’s not restricted to a single ICMP type—the key idea is embedding data in the ICMP payload to transfer binary information.

As for the other points: ICMP tunneling isn’t guaranteed to be easily detected or blocked by default, since many networks allow ICMP and only surface-level checks may miss unusual payloads; ICMP payloads can carry binary data, so that claim is false; and tunneling often uses echo messages rather than relying solely on ICMP error messages, so that statement isn’t accurate.