A network security analyst is investigating a compromised corporate subnet where users attempting to access internal file servers are periodically redirected to an unauthorized external server capturing credentials. A packet capture analysis on the local segment reveals two distinct operational anomalies:
1. Unsolicited, continuous ARP response frames broadcast across the segment, binding the subnet default gateway's IP address to an unrecognized host's MAC address.
2. Injected response packets intercepting local recursive name resolution requests and supplying spoofed IP addresses for internal domain names.
Which of the following attack vectors are directly being executed in this enterprise incident? (Select TWO)
- ARP Poisoning (Spoofing) to establish a Layer 2 On-path (Man-in-the-Middle) position by altering local host neighbor cachesAnswer
- BVLAN Hopping utilizing double 802.1Q encapsulation tags to bypass Layer 3 boundary security enforcement
- DNS Poisoning (Spoofing) to compromise name-to-IP resolution and redirect domain lookup queries to unauthorized IP addressesAnswer
- DPort Downgrade Attack forcing secure TLS communications on port 443 onto unencrypted Telnet transport on port 23
Answer
The two attack vectors actively being executed are ARP Poisoning (Spoofing) and DNS Poisoning (Spoofing).
The scenario describes two distinct malicious actions: local ARP table corruption via unsolicited ARP responses (ARP Poisoning) to position the attacker as an On-path intermediary, and the injection of fraudulent DNS resolution answers (DNS Poisoning) to redirect users to unauthorized IP destinations.
Step-by-Step Solution
Key Concept
Common Network Attack Types and Vectors (ARP Poisoning and DNS Spoofing)
Estimated Time:3m 0s