Examkin

Question

Difficulty: HardCommon Network Attack Types and Vectors

During an internal penetration test, an analyst connects a laptop to a standard user access port on a Managed Layer 2 switch. Without deploying double-encapsulated 802.1Q tags or compromising any credentials, the analyst crafts specific control frames that force the switch port into an active trunking state. This allows the laptop to send and receive traffic across multiple restricted VLANs. Which attack vector was exploited to breach VLAN isolation, and what is the primary mitigation step required to prevent it?

  1. Dynamic Trunking Protocol (DTP) exploitation; mitigate by explicitly setting switch ports to static access mode and disabling negotiation.Answer
  2. B
    Address Resolution Protocol (ARP) poisoning; mitigate by enabling Dynamic ARP Inspection (DAI) and binding DHCP snooping tables.
  3. C
    DNS Cache Poisoning; mitigate by enforcing DNSSEC records and locking UDP port 53 outbound traffic.
  4. D
    802.1Q Double-Tagging; mitigate by changing the native VLAN ID on trunk links to match the target access VLAN ID.

Answer

Dynamic Trunking Protocol (DTP) exploitation; mitigate by explicitly setting switch ports to static access mode and disabling negotiation.
The correct answer identifies Dynamic Trunking Protocol (DTP) exploitation. When switch access ports are left in default dynamic modes (such as dynamic auto or desirable), an attacker sending spoofed DTP frames can trick the switch into forming an 802.1Q trunk. This grants the attacker access to all VLANs traversing that trunk. Hardcoding access ports statically (`switchport mode access`) and explicitly disabling DTP (`switchport nonegotiate`) prevents this vulnerability.

Step-by-Step Solution

1
Analyze the observed attack mechanics
The attacker connected to a standard access port and sent control frames that successfully negotiated an 802.1Q trunking operational state without using double-tagging.
Unmanaged or default switch port configurations often run Cisco Dynamic Trunking Protocol (DTP) in 'dynamic auto' or 'dynamic desirable' modes.
2
Identify the specific attack vector
The vector is DTP Exploitation (VLAN Hopping via DTP spoofing).
By spoofing DTP negotiation frames from an end-user device, the port switches from an access port to a trunk port, giving the attacker access to traffic from all VLANs allowed on the trunk.
3
Determine the proper remediation strategy
Configure user-facing interfaces with `switchport mode access` and `switchport nonegotiate` (or manually disable DTP).
Hardcoding ports as static access interfaces disables automatic trunk negotiation, ensuring that end-user ports cannot be coerced into establishing trunk links.

Key Concept

VLAN Hopping via Dynamic Trunking Protocol (DTP) Exploitation and Switch Port Hardening
Rate this question

Topics

Common Network Attack Types and Vectors

More questions from this topic