Examkin

Question

Difficulty: MediumCommon Network Attack Types and Vectors

During an internal security investigation, network administrators notice that whenever client workstations experience a failure resolving internal hostnames via the primary DNS server, an unauthorized endpoint on the same broadcast domain immediately responds to Link-Local Multicast Name Resolution (LLMNR) and NetBIOS Name Service (NBT-NS) queries. The rogue system provides its own IP address, tricking victim computers into sending authentication hashes when trying to access network shares.

Which of the following correctly identify the attack vector taking place and the primary security risk established by this activity? (Select TWO.)

  1. Link-Local Multicast Name Resolution (LLMNR) / NBT-NS poisoningAnswer
  2. Man-in-the-Middle (MitM) positioning for credential harvestingAnswer
  3. C
    DNS cache poisoning of the authoritative domain server
  4. D
    Address Resolution Protocol (ARP) cache poisoning

Answer

The attack taking place is Link-Local Multicast Name Resolution (LLMNR) / NBT-NS poisoning, and the primary risk established is Man-in-the-Middle (MitM) positioning for credential harvesting.
The scenario describes an attacker taking advantage of Windows fallback name resolution protocols (LLMNR and NBT-NS). When normal DNS resolution fails, clients broadcast requests to the local network; an attacker spoofing these responses directs client traffic to their own machine, acting as a Man-in-the-Middle to harvest authentication credentials.

Step-by-Step Solution

1
Analyze the observed attack mechanics from the scenario.
Workstations send multicast/broadcast queries on the local subnet when DNS fails, and a rogue endpoint answers them with spoofed IP addresses.
This behavior specifically matches LLMNR/NBT-NS poisoning, which targets Windows fallback hostname resolution.
2
Determine the impact on network security and traffic flow.
Clients attempt authentication against the rogue endpoint, allowing the attacker to intercept NTLM authentication hashes.
Intercepting traffic intended for internal servers puts the attacker in a Man-in-the-Middle position to harvest credentials.

Key Concept

LLMNR/NBT-NS Poisoning and MitM Credential Interception
Rate this question

Topics

Common Network Attack Types and Vectors

More questions from this topic