A security analyst investigates packet capture data and network syslog alerts from an enterprise workstation segment. The logs reveal multiple unsolicited gratuitous ARP reply frames mapping the IP address of the subnet default gateway to an unauthorized local host's MAC address. Concurrently, workstations requesting address records for the corporate portal `login.enterprise.local` receive forged response packets directing them to an external public IP address, bypassing the internal primary DNS server. Which of the following attack indicators and techniques are demonstrated in this security incident? (Select TWO.)
- ARP poisoning utilized to establish an on-path (man-in-the-middle) network position on the local subnet.Answer
- DNS spoofing utilized to alter hostname resolution and redirect client authentication traffic.Answer
- CVLAN hopping executed via 802.1Q double-tagging to bypass inter-VLAN routing controls.
- DMAC flooding targeted at exhausting the switch CAM table to force fail-open unicast flooding.
Answer
The observed security incident combines ARP poisoning (using gratuitous ARP frames to map the default gateway IP to an unauthorized MAC address for on-path traffic interception) and DNS spoofing (injecting forged hostname resolution packets to redirect users to an external IP).
The scenario demonstrates ARP poisoning and DNS spoofing. The presence of unsolicited gratuitous ARP replies remapping the default gateway IP address to an unauthorized host MAC address is the definitive indicator of ARP cache poisoning, establishing an on-path position. Simultaneously, forged DNS resolution responses redirecting internal domain queries to an external address represent DNS spoofing.
Step-by-Step Solution
Key Concept
Network Attack Indicators: ARP Poisoning and DNS Spoofing
Estimated Time:2m 0s