Examkin

Question

Difficulty: EasyCommon Network Attack Types and Vectors

A network technician observes that network traffic intended for the local default gateway is being intercepted by an unauthorized computer on the same subnet. Investigation reveals that the unauthorized computer sent spoofed Address Resolution Protocol messages to update the IP-to-MAC address resolution tables of neighboring hosts. Which of the following attack types is taking place?

  1. ARP poisoningAnswer
  2. B
    DNS poisoning
  3. C
    Port mismatch attack
  4. D
    DNS CNAME redirection

Answer

ARP poisoning is occurring because spoofed ARP messages are being used to manipulate the local hardware address resolution table.
The correct option is ARP poisoning because the attack specifically targets the Address Resolution Protocol by injecting falsified IP-to-MAC address mappings into local host cache tables, allowing traffic interception on the local subnet.

Step-by-Step Solution

1
Analyze the observed attack mechanics described in the scenario.
The attack manipulates local IP-to-MAC address mapping tables using forged messages on the local subnet.
Address Resolution Protocol (ARP) translates Layer 3 IP addresses into Layer 2 MAC addresses.
2
Differentiate local Layer 2 spoofing from remote Layer 7 name resolution attacks.
Altering IP-to-MAC tables locally is ARP poisoning, whereas altering domain-name-to-IP tables is DNS poisoning.
ARP functions at Layer 2/3 for local subnets, while DNS functions at Layer 7 for hostname resolution.

Key Concept

ARP Poisoning (ARP Spoofing)
Rate this question

Topics

Common Network Attack Types and Vectors

More questions from this topic