A network security analyst is investigating logs from multiple enterprise security incidents across the network infrastructure. Match each observed attack symptom and mechanism to its corresponding network attack vector.
- An unauthorized frame with nested 802.1Q headers is sent over an access port configured on the switch's native VLAN, causing the outer tag to be stripped at the first switch and the frame forwarded to a restricted VLAN.VLAN Hopping (Double Tagging)
- Small UDP request packets with spoofed target source IP addresses are transmitted to open network time infrastructure using commands like monlist, resulting in massive response payloads targeting the victim.NTP Amplification Attack
- An adversary on the local network path intercepts initial unencrypted HTTP requests, dynamically replacing secure HTTPS links with plain HTTP equivalents to intercept credentials in cleartext.SSL/TLS Stripping (Downgrade Attack)
- Spoofed 802.11 management frames containing disassociation control codes are broadcast to force connected wireless clients off an authorized access point.Wireless Deauthentication Attack
Answer
The correct pairings are: 1) Nested 802.1Q headers on a native VLAN corresponds to VLAN Hopping (Double Tagging); 2) Spoofed UDP requests using monlist commands correspond to an NTP Amplification Attack; 3) Intercepting HTTP/HTTPS redirects to downgrade connection security corresponds to SSL/TLS Stripping; 4) Spoofed 802.11 disassociation management frames correspond to a Wireless Deauthentication Attack.
Each attack vector maps directly to its underlying technical exploit method: nested 802.1Q headers exploit switch native VLAN parsing (VLAN Hopping), monlist query responses reflect high-volume traffic (NTP Amplification), modifying HTTP location headers prevents encryption (SSL Stripping), and spoofing 802.11 management frames forces wireless disassociation (Deauthentication).
Step-by-Step Solution
Key Concept
Common Network Attack Vectors and Mechanisms