A network security administrator detects anomalous network activity where a switch is broadcasting unicast frames to all active switch ports, enabling an unauthorized user to capture sensitive network traffic. Investigation reveals that a connected device transmitted tens of thousands of frames with distinct, randomly generated source physical addresses within a few seconds. Which of the following statements accurately characterize the attack vector taking place and its primary mitigation method? (Select TWO)
- The threat actor is executing a MAC flooding attack designed to exhaust the switch's Content Addressable Memory (CAM) table capacity.Answer
- BThe incident is a DNS cache poisoning attack intended to corrupt hostname-to-IP resolution on the local gateway.
- Implementing Port Security on switch access interfaces effectively mitigates this attack by limiting the number of learned MAC addresses.Answer
- DModifying internal DNS CNAME records prevents the switch forwarding table from entering fail-open broadcast behavior.
Answer
The incident is a MAC flooding attack aimed at overflowing the switch's CAM table, which can be mitigated by configuring Port Security on switch ports.
A MAC flooding attack sends numerous frames containing invalid source MAC addresses to fill the switch's CAM table. Once full, the switch enters fail-open mode, broadcasting all traffic like a hub and allowing unauthorized packet capture. Port Security directly defends against this by enforcing limits on MAC address learning per port.
Step-by-Step Solution
Key Concept
MAC Flooding and Port Security
Estimated Time:1m 30s