Examkin

Question

Difficulty: MediumCommon Network Attack Types and Vectors

A network administrator at a branch office discovers that several newly connected workstation clients are receiving IP configuration parameters from an unauthorized scope outside the corporate network design. Analysis reveals that these clients were assigned a default gateway address belonging to an unknown laptop on the local segment, causing all outbound traffic from these clients to be intercepted. Which of the following attack types is being executed?

  1. Rogue DHCP server attackAnswer
  2. B
    ARP poisoning attack
  3. C
    DNS AAAA record redirection
  4. D
    Telnet port forwarding exploit

Answer

The attack described is a rogue DHCP server attack, as an unauthorized device is distributing network configurations and setting itself as the default gateway.
A rogue DHCP server intercepts client network deployment by answering DHCP client broadcasts with rogue IP parameters and specifying the attacker's machine as the default gateway, enabling on-path traffic eavesdropping.

Step-by-Step Solution

1
Analyze the incident symptoms presented in the scenario.
Newly connected clients are receiving invalid IP subnet leases and an unauthorized default gateway pointing to an unknown host on the local segment.
Identifying how the malicious parameters were delivered pinpoints the service protocol involved.
2
Correlate the delivery vector with common network attack mechanisms.
The parameters (IP configuration and default gateway) are assigned during network initiation via DHCP. An unauthorized host responding to DHCPDISCOVER requests is operating as a rogue DHCP server.
Rogue DHCP servers exploit unauthenticated DHCP broadcast requests to provide clients with malicious default gateway setting for man-in-the-middle positioning.

Key Concept

Rogue DHCP Server Attack Vector
Estimated Time:1m 15s
Rate this question

Topics

Common Network Attack Types and Vectors

More questions from this topic