Examkin

Question

Difficulty: MediumCommon Network Attack Types and Vectors

A security technician is investigating a multi-stage incident on an enterprise network segment. Packet logs reveal that an unauthorized internal host transmitted forged Gratuitous ARP messages to map the IP address of the default gateway to its own physical address. Simultaneously, internal users reported that entering legitimate domain names into their web browsers redirected them to a suspicious external IP address hosted on an unauthorized server. Which of the following attack types were executed during this incident? (Select TWO.)

  1. ARP PoisoningAnswer
  2. DNS PoisoningAnswer
  3. C
    MAC Flooding
  4. D
    VLAN Hopping

Answer

The attack types executed in this scenario are ARP Poisoning and DNS Poisoning.
ARP Poisoning occurs when forged ARP messages alter the MAC-to-IP mapping on local hosts, misdirecting traffic intended for the gateway. DNS Poisoning alters domain name resolution data so that queries for legitimate web services return malicious IP addresses.

Step-by-Step Solution

1
Analyze the first incident symptom
Identified forged Gratuitous ARP packets remapping the default gateway's IP to an attacker's MAC address.
This behavior directly defines ARP poisoning (or ARP spoofing), enabling man-in-the-middle positioning on Layer 2.
2
Analyze the second incident symptom
Identified domain name queries resolving to an unauthorized destination IP address.
Altering or spoofing name resolution responses to redirect users to unauthorized web servers defines DNS cache poisoning/spoofing.

Key Concept

Identifying Man-in-the-Middle and redirection attack vectors based on network signatures
Rate this question

Topics

Common Network Attack Types and Vectors

More questions from this topic