Examkin

Question

Difficulty: HardCommon Network Attack Types and Vectors

During a security assessment of an enterprise LAN segment, a network technician observes that host traffic intended for the default gateway at IP address 192.168.10.1192.168.10.1 is being redirected through an unauthorized laptop at 192.168.10.88192.168.10.88. Packet inspection reveals that host machines are continuously receiving unsolicited frame updates mapping 192.168.10.1192.168.10.1 to MAC address `00:11:22:AA:BB:CC`, which belongs to the laptop. Which network attack type is taking place, and what is its primary vector?

  1. ARP poisoning, which exploits the lack of authentication in ARP responses to update host ARP caches with forged IP-to-MAC address mappings.Answer
  2. B
    DNS spoofing, which corrupts local domain resolution caches to map the gateway domain name to an incorrect IP address.
  3. C
    MAC flooding, which targets switch CAM tables over TCP port 80 to force switch interfaces into a fail-open broadcast hub state.
  4. D
    DNS amplification, which leverages misconfigured recursive CNAME records to reflect magnified response traffic back to the gateway IP address.

Answer

ARP poisoning, which exploits the lack of authentication in ARP responses to update host ARP caches with forged IP-to-MAC address mappings.
The correct answer identifies ARP poisoning. ARP is a stateless Layer 2 protocol that maps IPv4 addresses to MAC addresses. Because ARP lacks authentication, hosts accept unsolicited ARP responses, allowing an attacker to broadcast forged ARP replies that associate their own MAC address with the IP address of the legitimate default gateway.

Step-by-Step Solution

1
Analyze the observed network symptom
Unsolicited frames map default gateway IP 192.168.10.1192.168.10.1 to an unauthorized host's MAC address `00:11:22:AA:BB:CC`.
This indicates targeted Layer 2 address cache tampering rather than domain name resolution or volumetric flooding.
2
Identify the protocol and vulnerability involved
Address Resolution Protocol (ARP) is inherently stateless and unauthenticated, accepting gratuitous ARP replies without validation.
Because hosts accept these responses, their local ARP tables are updated with spoofed bindings.
3
Determine the specific attack classification
The attack is ARP poisoning (or ARP spoofing), facilitating an On-Path (Man-in-the-Middle) scenario.
Traffic destined for external networks passes to the attacker's MAC address first before being forwarded.

Key Concept

ARP Poisoning and Spoofing Vectors
Rate this question

Topics

Common Network Attack Types and Vectors

More questions from this topic