Examkin

Question

Difficulty: MediumCommon Network Attack Types and Vectors

During a routine network security audit, an administrator notices that internal workstation traffic destined for external web services is being redirected to an unauthorized local host on the same switch segment. An inspection of local workstation cache tables reveals that the default gateway's IP address has been mapped to the attacker's network interface card address, allowing the attacker to inspect and modify traffic prior to forwarding it. Which of the following attack types has occurred?

  1. ARP PoisoningAnswer
  2. B
    DNS Poisoning
  3. C
    Port Scanning
  4. D
    DNS Amplification

Answer

ARP Poisoning
ARP Poisoning occurs when an attacker broadcasts spoofed Address Resolution Protocol messages across a local area network. This links the attacker's MAC address with the IP address of a legitimate target, such as the default gateway, enabling the attacker to intercept, inspect, or modify local network traffic.

Step-by-Step Solution

1
Analyze the observed anomaly in the scenario
Workstation traffic destined for the default gateway is being routed to an unauthorized host on the local ethernet segment.
The attacker has modified local workstation address resolution tables.
2
Evaluate the underlying mechanism causing the address cache corruption
The mapping between the default gateway's IP address and a physical MAC address was altered in the local ARP table.
Address Resolution Protocol (ARP) translates Layer 3 IP addresses into Layer 2 MAC addresses on local subnets.
3
Identify the specific network attack matching this mechanism
The attack is ARP Poisoning (or ARP Spoofing).
Unsolicited or malicious ARP responses overwrite legitimate MAC address bindings in the target host's ARP cache.

Key Concept

Address Resolution Protocol (ARP) Poisoning and Man-in-the-Middle (MitM) Attacks
Estimated Time:1m 15s
Rate this question

Topics

Common Network Attack Types and Vectors

More questions from this topic