Examkin

Question

Difficulty: MediumNetwork and Wireless Attack Indicators

A network security administrator is investigating reports of intermittent network interception on a local subnet. Upon inspecting the ARP table of a target workstation, the administrator records the following entry state:

IP AddressMAC AddressBinding Type
192.168.1.100-11-22-AA-BB-CCDynamic
192.168.1.10500-11-22-AA-BB-CCDynamic

Where 192.168.1.1 is the default gateway and 192.168.1.105 belongs to an unauthorized host on the network. Which of the following attack types is indicated by these findings?

  1. ARP PoisoningAnswer
  2. B
    DNS Cache Poisoning
  3. C
    VLAN Hopping
  4. D
    MAC Flooding

Answer

ARP Poisoning
ARP poisoning is characterized by spoofed ARP responses that bind an attacker's MAC address to the IP address of a legitimate host or gateway on the local network. The ARP cache output clearly demonstrates two distinct IP addresses bound to the exact same physical MAC address (00-11-22-AA-BB-CC), indicating traffic redirection to the attacker's system.

Step-by-Step Solution

1
Analyze the observed network indicator table
The gateway IP (192.168.1.1) and host IP (192.168.1.105) both map to the identical MAC address 00-11-22-AA-BB-CC.
In standard IPv4 Ethernet networks, each IP address on a local segment must map to a unique physical network interface MAC address.
2
Identify the underlying mechanism and protocol vulnerability
Unsolicited ARP responses (Gratuitous ARP) allow an attacker host to overwrite legitimate entries in local ARP caches.
Address Resolution Protocol (ARP) lacks intrinsic authentication mechanisms, making local devices trust incoming ARP responses.
3
Select the matching attack classification
Mapping an attacker's hardware address to a gateway IP address is the core indicator of ARP poisoning.
This setup allows the unauthorized host to execute an On-Path (Man-in-the-Middle) attack by intercepting subnet traffic destined for the gateway.

Key Concept

ARP Poisoning Indicators
Rate this question

Topics

Network and Wireless Attack Indicators

More questions from this topic