Examkin

Question

Difficulty: HardKey Security Concepts, Threats, Vulnerabilities, and Mitigations

During an ongoing incident response investigation, a network analyst detects that an unauthorized host on an internal VLAN is transmitting spoofed Neighbor Discovery (ND) Router Advertisement messages to redirect host traffic through itself before forwarding it to the actual default gateway. Concurrently, the IT security department is seeking a control to prevent unauthorized account access resulting from compromised or stolen user passwords used across corporate endpoints. Which combination correctly identifies the active network attack vector and the most effective mitigation control against the password compromise risk?

  1. Attack Vector: Man-in-the-Middle (MitM) attack; Mitigation Control: Multi-Factor Authentication (MFA)Answer
  2. B
    Attack Vector: Distributed Denial of Service (DDoS) attack; Mitigation Control: Port Security sticky MAC learning
  3. C
    Attack Vector: Reconnaissance attack; Mitigation Control: TACACS+ authentication protocol
  4. D
    Attack Vector: Vulnerability buffer overflow attack; Mitigation Control: Standard Access Control Lists (ACLs)

Answer

Attack Vector: Man-in-the-Middle (MitM) attack; Mitigation Control: Multi-Factor Authentication (MFA)
The correct answer accurately pairs the observed attack vector with its corresponding mitigation control. Transmitting unauthorized protocol messages to place a machine between legitimate communicating hosts is the textbook definition of a Man-in-the-Middle (MitM) attack. To protect against compromised user credentials, Multi-Factor Authentication (MFA) is the standard control, as it requires an additional proof of identity beyond the knowledge of a password.

Step-by-Step Solution

1
Analyze the active network incident description to classify the attack vector.
The attacker sends spoofed protocol messages (IPv6 Neighbor Discovery Router Advertisements) to position their rogue host as an inline intermediary between clients and the default gateway. Intercepting and inspecting or altering traffic in transit defines a Man-in-the-Middle (MitM) attack.
Correctly identifying threat vectors requires matching observable network behavior against standard threat definitions.
2
Evaluate the secondary security requirement regarding stolen password reuse.
When user passwords are compromised, single-factor authentication fails. Multi-Factor Authentication (MFA) adds a second required factor (e.g., authenticator app push, security key), rendering stolen static passwords insufficient for unauthorized access.
Matching security controls to specific vulnerabilities ensures effective defense-in-depth planning.
3
Synthesize findings to choose the correct pair.
The combination of Man-in-the-Middle (MitM) attack for the active traffic redirection scenario and Multi-Factor Authentication (MFA) for credential risk protection is the accurate pairing.
Only one option correctly pairs both identified security elements.

Key Concept

Threat Vector Classification and Security Mitigation Selection
Rate this question

Topics

Key Security Concepts, Threats, Vulnerabilities, and Mitigations

More questions from this topic