Examkin

Question

Difficulty: Very hardNetwork and Wireless Attack Indicators

An enterprise security operations center (SOC) detects anomalous network and wireless activity across multiple site logs during a synchronized red-team exercise. Match each observed technical log snippet or packet capture indicator to its corresponding network or wireless attack classification.

  • Syslog alert: 'MAC 00:11:22:33:44:55 associated with BSSID AA:BB:CC:DD:EE:FF sent 802.11 Reason Code 7 (Class 3 frame received from nonassociated STA) to 150 clients simultaneously.'Deauthentication / Disassociation Attack
  • Packet capture snippet: Repeated ARP replies broadcasted to 192.168.1.255 stating IP 192.168.1.1 is at MAC 00:AA:11:BB:22:CC, while switches report 192.168.1.1 active port MAC as 00:11:22:33:44:55.ARP Poisoning / Man-in-the-Middle
  • Wireless analyzer log: Broadcast beacon frames detected for SSID 'Corp-Secure' on Channel 6 using WPA2-Enterprise with BSSID 02:14:6C:AA:BB:CC, matching the enterprise SSID but operating at a significantly higher RSSI (-35 dBm) than legitimate APs (-72 dBm).Evil Twin / Rogue Access Point
  • SIEM log event: DNS server log showing sudden resolution of intranet.corp.internal from 10.0.5.50 to 192.168.100.45 following non-authoritative UDP port 53 response injection without query ID mismatch alerts on clients.DNS Cache Poisoning / Spoofing

Answer

The correct pairings match each technical log snippet to its distinct attack indicator: 802.11 Reason Code 7 management frames indicate a Deauthentication attack; mismatched ARP gateway MAC bindings indicate ARP Poisoning; a high-RSSI unauthorized AP matching corporate SSID indicates an Evil Twin; and unauthorized IP resolution via forged records indicates DNS Cache Poisoning.
Each indicator uniquely aligns with standard protocol behaviors under attack: 802.11 disassociation frames force client disconnections; gratuitous ARP replies corrupt local MAC resolution tables; unauthorized high-power BSSIDs spoofing corporate SSIDs represent Evil Twins; and corrupt DNS response mappings indicate DNS cache poisoning.

Step-by-Step Solution

1
Analyze the wireless management frame log snippet (802.11 Reason Code 7).
Reason Code 7 signifies disassociation due to class 3 frame receipt from a nonassociated station. Mass broadcast indicates a wireless disassociation/deauthentication attack.
Identify wireless denial-of-service or credential-harvesting pre-attack indicators.
2
Analyze the ARP packet capture log.
Discrepancy between broadcasted ARP reply MAC addresses and physical switch port MAC tables points to gratuitous/unsolicited ARP spoofing used for on-path interception.
Distinguish ARP poisoning indicators from normal network ARP traffic.
3
Analyze the wireless beacon frame capture for Corp-Secure.
An unauthorized BSSID advertising the legitimate SSID with an unusually high RSSI indicates a malicious rogue AP configured as an Evil Twin.
Recognize rogue wireless infrastructure masquerading as legitimate corporate access points.
4
Analyze the DNS resolution anomaly log.
Forged responses updating cached IP mapping for internal domain names demonstrate DNS cache poisoning.
Differentiate protocol spoofing at layer 7 (DNS) from layer 2 (ARP) and layer 1/2 (Wireless).

Key Concept

Identification and analysis of network and wireless attack indicators including ARP poisoning, DNS cache poisoning, Evil Twin access points, and 802.11 disassociation attacks.
Estimated Time:3m 0s
Rate this question

Topics

Network and Wireless Attack Indicators

More questions from this topic