Examkin

Question

Difficulty: HardCommon Network Attack Types and Vectors

During a security incident response on subnet 192.168.50.0/24192.168.50.0/24, a network engineer observes that multiple workstations have lost connectivity to internal corporate servers and are transmitting sensitive traffic to an unapproved external address. Packet captures reveal a rapid influx of DHCP DISCOVER and REQUEST messages originating from thousands of randomly generated MAC addresses, which completely exhausts the legitimate DHCP server's IP address pool. Immediately after the pool is depleted, clients receive IP leases containing an unauthorized default gateway IP address broadcast by an unidentified device on the local Layer 2 broadcast domain. Which of the following attack types represents the primary vector used to hijack client traffic?

  1. A DHCP starvation attack combined with a rogue DHCP server injectionAnswer
  2. B
    An ARP cache poisoning attack targeting the default gateway interface
  3. C
    A DNS spoofing attack modifying authoritative address records
  4. D
    A SYN flood attack targeting port 67 on the core network switch

Answer

The attack executed is a DHCP starvation attack combined with a rogue DHCP server injection.
The scenario describes a classic two-stage network attack. First, the adversary floods the network with DHCP requests containing randomized MAC addresses, completely exhausting the legitimate DHCP server's available IP scope (DHCP starvation). Second, an unauthorized device answers subsequent client lease requests by assigning IP configurations that include a malicious default gateway (rogue DHCP server injection), effectively establishing a Man-in-the-Middle (MitM) position.

Step-by-Step Solution

1
Analyze the log signature showing thousands of DISCOVER/REQUEST packets with unique spoofed MAC addresses.
Identify that the legitimate DHCP scope pool on 192.168.50.0/24192.168.50.0/24 was intentionally exhausted (DHCP starvation).
Depleting available IP addresses prevents new or renewing hosts from acquiring legitimate network configurations.
2
Examine the client lease details received immediately after pool exhaustion.
Observe that clients accepted new network configurations, including a malicious default gateway, from an unauthorized device.
Once the legitimate server is starved, a rogue DHCP server can answer client requests faster and assign malicious gateway settings.
3
Correlate the multi-stage behavior to select the corresponding network attack vector.
Confirm that the combination of MAC address flooding and unauthorized lease generation constitutes DHCP starvation and rogue DHCP injection.
This specific multi-step vector relies on Layer 2 broadcasting of UDP port 67/68 traffic to manipulate endpoint routing.

Key Concept

DHCP Starvation and Rogue DHCP Server Injection
Rate this question

Topics

Common Network Attack Types and Vectors

More questions from this topic