Examkin

Question

Difficulty: MediumCommon Network Attack Types and Vectors

A network security analyst is updating incident classification guidelines for enterprise threat vectors. Match each network attack type on the left with its corresponding attack vector characteristics on the right.

  • Switch SpoofingTransmitting forged Dynamic Trunking Protocol (DTP) negotiation frames to force an access port into an active trunking state.
  • BluesnarfingUnauthorized extraction of calendar entries, contact lists, and messages from a wireless device over an unauthenticated Bluetooth connection.
  • DNS TunnelingEncoding non-DNS application payloads inside outbound lookup queries to covertly exfiltrate data through UDP port 53.
  • IP Address SpoofingManipulating header fields to substitute the original sender's IP address with a trusted or fake IP address to bypass access control lists.

Answer

Switch Spoofing matches DTP frame forgery for trunk negotiation; Bluesnarfing matches unauthorized Bluetooth data extraction; DNS Tunneling matches encoding non-DNS payloads in port 53 queries; IP Address Spoofing matches modifying source IP headers to bypass access controls.
Each attack type matches its exact vector description: Switch Spoofing exploits DTP negotiation to force trunking; Bluesnarfing extracts confidential data over Bluetooth; DNS Tunneling encapsulates covert data within standard port 53 queries; and IP Address Spoofing alters source IP header fields to bypass filters.

Step-by-Step Solution

1
Analyze Switch Spoofing mechanisms
Identify that switch spoofing exploits automatic switch port negotiation using DTP frames to create unauthorized VLAN trunks.
Understanding layer 2 dynamic trunk negotiation identifies the DTP forgery vector.
2
Differentiate Bluetooth attack categories
Distinguish Bluesnarfing (data theft/extraction) from Bluejacking (sending unsolicited messages).
Bluesnarfing specifically targets the exfiltration of personal data like contacts and text messages.
3
Examine covert tunnel characteristics
Recognize that DNS Tunneling utilizes port 53 lookup packets to encapsulate non-DNS protocol data for data exfiltration.
Firewalls often allow outbound DNS unconditionally, making it a primary covert channel vector.
4
Evaluate packet header alteration attacks
Associate IP Address Spoofing with forged source IP addresses in packet headers.
Spoofing IP addresses allows attackers to evade simple address-based filtering or misattribute traffic.

Key Concept

Common Network Attack Types and Vectors
Rate this question

Topics

Common Network Attack Types and Vectors

More questions from this topic