Examkin

Question

Difficulty: EasyCommon Network Attack Types and Vectors

An organization's network monitoring tool alerts administrators to an overwhelming volume of unsolicited UDP responses originating from public DNS servers, all targeted at a single internal web server. Investigation reveals that an external attacker sent small DNS requests with a spoofed source IP address corresponding to the target server. Which of the following network attack vectors is being executed?

  1. A
    DNS cache poisoning
  2. B
    ARP poisoning
  3. DNS amplification attackAnswer
  4. D
    Port scanning

Answer

The attack vector being executed is a DNS amplification attack.
A DNS amplification attack occurs when an attacker sends small DNS queries with a spoofed source IP address (belonging to the victim) to open recursive DNS resolvers. The resolvers respond with large payload answers to the victim's address, overwhelming the target's network bandwidth and causing a Denial of Service.

Step-by-Step Solution

1
Analyze the reported traffic pattern.
Unsolicited, high-volume UDP traffic is arriving from public DNS servers directed at a specific internal IP address.
Identifying the flow of traffic helps distinguish volumetric DDoS reflection attacks from local or targeted spoofing attacks.
2
Determine the attack technique based on the spoofed source IP mechanism.
Small requests were sent with the victim's IP as the return address, leveraging recursive resolvers to generate larger response payloads.
This reflective amplification mechanism is the defining characteristic of a DNS amplification DDoS attack.

Key Concept

DNS Amplification Attack
Estimated Time:45s
Rate this question

Topics

Common Network Attack Types and Vectors

More questions from this topic