Examkin

Question

Difficulty: MediumCommon Network Attack Types and Vectors

Match each common network attack type on the left with the primary mechanism or technical indicator that best characterizes its execution on the right.

  • Pass-the-HashAuthenticating to a remote server using extracted hashed credentials directly from memory without decrypting the cleartext password.
  • Smurf AttackSending spoofed ICMP echo requests to a network broadcast address so responding hosts overwhelm a targeted victim IP.
  • TCP SYN FloodTransmitting a high volume of connection initialization packets while withholding final acknowledgments to exhaust half-open queues.
  • Evil TwinOperating an unauthorized wireless access point configured with a legitimate network SSID to trick client devices into connecting.

Answer

Pass-the-Hash matches authenticating using extracted credential hashes directly; Smurf Attack matches sending spoofed ICMP echo requests to a broadcast address; TCP SYN Flood matches transmitting connection requests while withholding acknowledgments; Evil Twin matches operating an unauthorized access point configured with a legitimate SSID.
Each attack type matches its distinct execution vector: Pass-the-Hash authenticates via memory-harvested credential hashes without cracking cleartext passwords; a Smurf attack relies on ICMP broadcast reflection to amplify traffic against a victim; a TCP SYN flood exhausts connection state tables with incomplete handshakes; and an Evil Twin deploys a rogue wireless access point mimicking a trusted SSID.

Step-by-Step Solution

1
Analyze Pass-the-Hash authentication behavior.
Pass-the-Hash uses intercepted hash values directly in authentication protocols without converting them back to plaintext passwords.
This aligns with authenticating to a remote server using extracted hashed credentials from memory.
2
Examine the traffic reflection mechanism of a Smurf Attack.
Smurf attacks use ICMP echo requests with a spoofed target source IP directed to an IP broadcast address.
This corresponds to sending spoofed ICMP echo requests to a broadcast address to overwhelm a target.
3
Evaluate transport layer resource exhaustion in a TCP SYN Flood.
SYN floods exploit the TCP handshake by leaving connection requests in a SYN-RECEIVED state, consuming buffer resources.
This matches transmitting connection initialization packets while withholding final acknowledgments.
4
Determine wireless access point spoofing in an Evil Twin attack.
An Evil Twin mimics a legitimate wireless network identifier (SSID) to deceive wireless clients into connecting.
This matches operating an unauthorized wireless access point configured with a legitimate network SSID.

Key Concept

Identifying common network attack vectors, indicators, and execution mechanisms across layer 2 to layer 7 threats.
Rate this question

Topics

Common Network Attack Types and Vectors

More questions from this topic