Examkin

Question

Difficulty: MediumCommon Network Attack Types and Vectors

An enterprise security Operations center detects two distinct anomalous network activities. First, an external threat actor transmits forged requests to public time servers, causing heavy response traffic to flood an internal web server's public IP interface. Second, an internal rogue host answers local broadcast Link-Local Multicast Name Resolution (LLMNR) queries to redirect workstations to a fake login portal. Which of the following attack types and vectors are present in this scenario? (Select TWO)

  1. Reflected Denial of Service using NTP amplificationAnswer
  2. On-path credential harvesting via LLMNR poisoningAnswer
  3. C
    DNS cache poisoning via invalid CNAME record propagation
  4. D
    Layer 2 ARP poisoning of the default gateway switch

Answer

The scenario describes a Reflected Denial of Service using NTP amplification and On-path credential harvesting via LLMNR poisoning.
The correct choices accurately identify both attack vectors: NTP amplification leverages public time servers with spoofed source IPs to reflect amplified traffic onto a victim, while LLMNR poisoning intercepts local broadcast hostname queries to establish an on-path position for credential harvesting.

Step-by-Step Solution

1
Analyze the first anomaly involving external time servers.
Identified NTP amplification attack vector where spoofed requests cause public servers to generate large volumes of traffic targeting the victim.
Forging source IPs to generate disproportionate response traffic from third-party servers defines a reflected amplification DDoS attack.
2
Analyze the second anomaly involving local multicast name resolution requests.
Identified LLMNR poisoning attack vector where malicious hosts answer local name requests to intercept user credentials.
Spoofing broadcast/multicast local name resolution responses positions the attacker as an on-path entity to collect user authentication details.

Key Concept

Identifying Common Network Attack Vectors and Amplification Techniques
Rate this question

Topics

Common Network Attack Types and Vectors

More questions from this topic