Examkin

Question

Difficulty: Very hardCommon Network Attack Types and Vectors

A network security analyst is investigating simultaneous security alerts on two separate VLANs within an enterprise network. On VLAN 20, client workstations attempting to reach the internal ERP server (10.20.4.50) present browser certificate warnings. Packet captures on VLAN 20 show a flood of unsolicited ARP responses associating the default gateway IP address (10.20.4.1) with the MAC address of an unrecognized host on the local segment. On VLAN 30, clients resolving the hostname erp.corporate.local receive IP address 198.51.100.44 (an external host) instead of 10.20.4.50. Packet captures on VLAN 30 reveal forged UDP port 53 responses arriving prior to replies from the legitimate internal DNS server, with no abnormal Layer 2 ARP activity detected. Which of the following correctly identifies the distinct attack vectors operating on VLAN 20 and VLAN 30, respectively?

  1. VLAN 20 is undergoing ARP cache poisoning (Layer 2 Man-in-the-Middle), while VLAN 30 is undergoing DNS cache poisoning (DNS spoofing).Answer
  2. B
    VLAN 20 is undergoing DNS cache poisoning (DNS spoofing), while VLAN 30 is undergoing ARP cache poisoning (Layer 2 Man-in-the-Middle).
  3. C
    VLAN 20 is undergoing a MAC flooding attack on switch CAM tables, while VLAN 30 is undergoing a BGP route hijacking attack.
  4. D
    VLAN 20 is undergoing a DHCP starvation attack, while VLAN 30 is undergoing an IPv6 AAAA record transition attack.

Answer

VLAN 20 is undergoing ARP cache poisoning (Layer 2 Man-in-the-Middle), while VLAN 30 is undergoing DNS cache poisoning (DNS spoofing).
The scenario describes two distinct attack mechanisms. On VLAN 20, the adversary sends unsolicited ARP responses to bind the default gateway's IP address to a rogue MAC address, corrupting local ARP tables and creating a Layer 2 Man-in-the-Middle state (ARP cache poisoning). On VLAN 30, the adversary sends forged DNS reply packets over UDP port 53 that arrive before the legitimate server replies, poisoning client DNS caches with a malicious IP address (DNS cache poisoning).

Step-by-Step Solution

1
Analyze telemetry and packet behavior for VLAN 20.
Unsolicited ARP replies map the default gateway IP address (10.20.4.1) to an unauthorized host's MAC address, corrupting client ARP caches and redirecting Layer 2 frames through an intermediary machine (Man-in-the-Middle).
ARP operate at Layer 2 to map IP addresses to MAC addresses on local broadcast domains.
2
Analyze telemetry and packet behavior for VLAN 30.
Forged DNS responses delivered via UDP port 53 arrive faster than responses from the legitimate internal DNS server, causing clients to cache an external IP address for an internal hostname.
DNS spoofing / cache poisoning injects false hostname-to-IP mappings into resolvers by exploiting connectionless UDP responses.
3
Synthesize the findings to select the matching vector pair.
VLAN 20 exhibits ARP cache poisoning, while VLAN 30 exhibits DNS cache poisoning.
Differentiating Layer 2 MAC resolution spoofing from Layer 7 name resolution spoofing identifies the exact attack mechanisms.

Key Concept

Differentiating Layer 2 ARP Cache Poisoning from Layer 7 DNS Cache Poisoning Vectors
Estimated Time:2m 0s
Rate this question

Topics

Common Network Attack Types and Vectors

More questions from this topic