Examkin

Question

Difficulty: MediumCommon Network Attack Types and Vectors

A network security technician is analyzing packet captures from an enterprise user segment after host traffic was unexpectedly intercepted. The packet capture shows multiple unsolicited ARP responses associating the default gateway's IP address with an unauthorized host's MAC address. Which of the following options correctly identify the mechanism behind this incident and an effective defense? (Select TWO.)

  1. The underlying mechanism relies on sending spoofed gratuitous ARP frames to corrupt local MAC-to-IP translation tables.Answer
  2. B
    The attacker is executing a DNS cache poisoning attack by injecting malicious name resolution records into the local DNS server.
  3. Configuring Dynamic ARP Inspection (DAI) on Layer 2 switchports will validate ARP packets against trusted DHCP bindings.Answer
  4. D
    Deploying a DHCP relay agent on the router interface will inspect frame headers and prevent local MAC address spoofing.

Answer

The attack mechanism involves spoofing gratuitous ARP frames to alter host MAC-to-IP tables, and the effective defense is implementing Dynamic ARP Inspection (DAI) on access switch ports.
Unsolicited ARP replies linking a gateway IP to an attacker's MAC address indicate ARP poisoning. Spoofed gratuitous ARP frames corrupt local ARP tables to intercept network traffic. Implementing Dynamic ARP Inspection (DAI) on Layer 2 switches mitigates this vector by validating ARP responses against the DHCP snooping table.

Step-by-Step Solution

1
Analyze the packet capture anomaly
Unsolicited ARP replies binding the default gateway IP to an unauthorized MAC address indicate local Layer 2 ARP poisoning.
Address Resolution Protocol (ARP) translates Layer 3 IP addresses to Layer 2 MAC addresses without built-in authentication.
2
Identify the specific attack vector mechanism
Spoofed gratuitous ARP messages overwrite neighbor ARP cache entries across the broadcast domain.
Hosts accept incoming unsolicited ARP responses and update their translation tables dynamically.
3
Select the appropriate mitigation control
Dynamic ARP Inspection (DAI) intercept and drop invalid ARP replies on untrusted switch ports.
DAI cross-references incoming ARP requests and responses against the valid IP-to-MAC mappings in the DHCP snooping database.

Key Concept

Address Resolution Protocol (ARP) Poisoning and Dynamic ARP Inspection (DAI)
Rate this question

Topics

Common Network Attack Types and Vectors

More questions from this topic