Examkin

Question

Difficulty: MediumCommon Network Attack Types and Vectors

During a security audit, a network administrator discovers that an rogue laptop plugged into an unmanaged wall jack successfully established an 802.1Q trunking link with the local access switch by sending dynamic trunking negotiation messages. This enabled the device to capture and inject traffic across multiple internal VLANs. Which of the following network attack types did the rogue device execute?

  1. Switch spoofingAnswer
  2. B
    ARP poisoning
  3. C
    DNS cache poisoning
  4. D
    Port spoofing

Answer

Switch spoofing is the attack vector used by an unauthorized device to emulate a switch and negotiate an 802.1Q trunk link to access multiple VLANs.
Switch spoofing occurs when an attacker configures a system to send trunking negotiation packets (e.g., DTP frames) to a switch port configured in dynamic trunking mode. If successful, the switch negotiates a trunk link with the attacker's device, giving the attacker access to all traffic traveling across the trunked VLANs.

Step-by-Step Solution

1
Analyze the attack mechanism described in the scenario
The attacking host sends dynamic negotiation frames (such as Dynamic Trunking Protocol / DTP) to trick an switch port configured in dynamic auto/desirable mode into forming a trunk.
Establishing an 802.1Q trunk gives the connected device access to untagged and tagged frames across all VLANs allowed on that trunk interface.
2
Differentiate Layer 2 VLAN exploitation techniques
Configuring a rogue host to pretend to be a switch to form a trunk connection is explicitly defined as switch spoofing.
This contrasts with double tagging (VLAN hopping via nested 802.1Q tags) or ARP poisoning (manipulating local MAC-IP resolution tables).

Key Concept

Switch Spoofing and VLAN Security
Rate this question

Topics

Common Network Attack Types and Vectors

More questions from this topic