A tier-2 Security Operations Center (SOC) analyst is analyzing threat intelligence logs and network packet captures from a recent enterprise security incident. Match each observed technical attack metric or anomalous protocol behavior to its corresponding network attack classification.
- Rapid injection of frames containing randomized source physical addresses to saturate switch memory tables and force traffic onto all active ports.MAC Address Flooding
- Transmission of continuous TCP connection requests with spoofed return addresses to saturate embryonic socket queues without sending final ACK packets.TCP SYN Flood
- Emission of high-power electromagnetic noise across specific wireless spectrum channels to lower the signal-to-noise ratio and drop client connections.RF Jamming
- Operation of an unauthorized wireless base station configured with a duplicated Service Set Identifier (SSID) to intercept client traffic.Evil Twin Access Point
Answer
The correct pairings match MAC Address Flooding with saturating switch memory via randomized source addresses; TCP SYN Flood with filling embryonic connection queues using unacknowledged SYN packets; RF Jamming with emitting high-power noise to lower wireless SNR; and Evil Twin Access Point with deploying an unauthorized base station using a duplicated SSID.
Each attack vector targets specific network layers and operational characteristics: MAC address flooding targets Layer 2 switch CAM tables by exhausting memory entries; TCP SYN flooding targets Layer 4 TCP connection state queues by leaving handshakes incomplete; RF jamming targets Layer 1 physical wireless channels by suppressing signal-to-noise ratios; and Evil Twin attacks target Layer 2 802.11 association procedures by impersonating valid network SSIDs.
Step-by-Step Solution
Key Concept
Identifying Network Attack Types and Operational Vectors across OSI Layers