Examkin

Question

Difficulty: MediumNetwork and Wireless Attack Indicators

Match each observed wireless or network attack technical indicator to its corresponding security threat classification.

  • Packet capture logs displaying continuous transmission of IEEE 802.11 management frames with subtype 0x000C sent to client MAC addresses with spoofed access point source addresses.Deauthentication Attack
  • Spectrum analyzer logs recording high-power broadband carrier noise across the 2.4 GHz ISM band causing a complete collapse in the signal-to-noise ratio (SNR).RF Jamming Attack
  • System logs showing unsolicited Bluetooth L2CAP and Service Discovery Protocol (SDP) requests pushing unwanted text contact notes to nearby discoverable mobile devices.Bluejacking Attack
  • Packet captures recording unauthorized ICMPv6 Type 134 messages broadcast from a unauthorized endpoint to dynamically reconfigure neighbor default routing paths.Rogue IPv6 Router Advertisement Attack

Answer

The observed technical indicators match as follows: 802.11 management frames (subtype 0x000C) match Deauthentication Attack; broadband high-power noise matches RF Jamming Attack; unsolicited Bluetooth text messages match Bluejacking Attack; unauthorized ICMPv6 Type 134 broadcasts match Rogue IPv6 Router Advertisement Attack.
Each indicator directly corresponds to its characteristic protocol behavior: 802.11 subtype 0x000C identifies wireless deauthentication; RF spectrum noise indicates physical radio frequency jamming; unsolicited Bluetooth message delivery represents Bluejacking; and unauthorized ICMPv6 Type 134 frames represent a rogue IPv6 Router Advertisement attack.

Step-by-Step Solution

1
Analyze frame subtypes and protocol headers in wireless packet captures.
IEEE 802.11 subtype 0x000C specifically designates Deauthentication management frames designed to drop wireless client connections.
Identifying specific frame types isolates wireless denial-of-service vectors.
2
Evaluate RF spectrum metrics and signal noise metrics.
Continuous high-power noise overwhelming the signal-to-noise ratio indicates intentional intentional physical layer interference (RF Jamming).
Jamming impacts physical layer propagation rather than logical protocol exchanges.
3
Examine short-range wireless protocol traffic and payload types.
Unsolicited messaging via Bluetooth SDP/L2CAP characterizes Bluejacking (distinguished from Bluesnarfing, which steals data).
Bluejacking focuses on sending messages rather than exfiltrating stored data.
4
Inspect ICMPv6 packet types and network layer routing announcements.
ICMPv6 Type 134 corresponds to Router Advertisements (RA). Unauthorized RA messages alter host IPv6 gateway configurations.
IPv6 Stateless Address Autoconfiguration (SLAAC) relies on ICMPv6 Type 134, making rogue RAs a prominent network layer threat indicator.

Key Concept

Technical Indicators of Network and Wireless Attacks
Estimated Time:1m 30s
Rate this question

Topics

Network and Wireless Attack Indicators

More questions from this topic