Examkin

Question

Difficulty: MediumCommon Network Attack Types and Vectors

During an incident investigation on an enterprise local area network, a network administrator notices that a host workstation is sending traffic intended for the default gateway (192.168.1.1) to an unassigned MAC address (00:11:22:33:44:55) on the local switch port. Packet captures reveal unsolicited Address Resolution Protocol responses continuously mapping the gateway's IP address to the attacker's MAC address. Which of the following attack types is actively occurring on this network segment?

  1. ARP poisoningAnswer
  2. B
    DNS cache poisoning
  3. C
    Rogue DHCP server attack
  4. D
    DNS record misconfiguration

Answer

The attack occurring on the local network segment is ARP poisoning.
The correct answer describes ARP poisoning. In ARP poisoning (or ARP spoofing), an attacker broadcasts forged, unsolicited ARP reply frames across a local area network to associate their own MAC address with the IP address of a legitimate target, such as the default gateway. This causes client workstations to forward network traffic directly to the attacker's machine.

Step-by-Step Solution

1
Analyze the observed network symptom
Unsolicited ARP responses are corrupting the host's ARP table by mapping the default gateway's IP address (192.168.1.1) to an unauthorized MAC address.
ARP (Address Resolution Protocol) maps Layer 3 IP addresses to Layer 2 MAC addresses on local broadcast domains.
2
Differentiate Layer 2 protocol manipulation from Layer 7 name resolution
The traffic manipulation is occurring at Layer 2 via ARP frame injection, not at Layer 7 through DNS name resolution tampering.
ARP operates strictly within local subnets to resolve MAC addresses for frame forwarding, while DNS maps hostnames to IP addresses.
3
Select the matching attack classification
ARP poisoning (or ARP spoofing) is identified as the exact mechanism used to facilitate this on-path attack.
Forging ARP responses to associate an attacker's MAC address with a target host's IP address directly matches the definition of ARP poisoning.

Key Concept

ARP Poisoning / ARP Spoofing
Rate this question

Topics

Common Network Attack Types and Vectors

More questions from this topic