Examkin

Question

Difficulty: MediumNetwork and Wireless Attack Indicators

A security technician analyzing network packet captures following a reported credential compromise notes that multiple workstations are issuing UDP port 5355 multicast requests after failing standard DNS name resolution for local resources. Immediately following each multicast query, an unauthorized host on the local subnet returns spoofed name resolution responses, directing the victim workstations to initiate SMB authentication over TCP port 445 to the attacker's machine. Which of the following technical indicators specifically confirm the presence of this attack? Select TWO.

  1. Unicast UDP port 5355 responses sent by a single non-authoritative host answering broadcast requests for internal server namesAnswer
  2. B
    Frequent ICMPv6 Type 134 Router Advertisement packets altering default gateway routes across local VLAN segments
  3. Unsolicited SMB NTLMv2 challenge-response hash transmissions routed to an unauthorized internal IP addressAnswer
  4. D
    Repeated 802.11 management frames containing Reason Code 7 directed at authenticated wireless endpoints

Answer

The correct indicators are unicast UDP port 5355 responses sent by a non-authoritative host answering broadcast queries for internal names, and unsolicited SMB NTLMv2 challenge-response hash transmissions routed to an unauthorized internal IP address.
The scenario describes LLMNR (Link-Local Multicast Name Resolution) poisoning. When Windows clients fail standard DNS resolution, they broadcast LLMNR queries on UDP port 5355. An attacker operating a listener responds with spoofed unicast replies. When the victim client attempts to connect to the target resource via SMB, it sends its NTLMv2 challenge-response hash to the attacker's machine.

Step-by-Step Solution

1
Identify the primary name resolution protocol associated with UDP port 5355 multicast traffic.
UDP 5355 corresponds to Link-Local Multicast Name Resolution (LLMNR), which endpoints use when DNS lookup fails.
Recognizing port-protocol mappings establishes the baseline vulnerability mechanism.
2
Analyze how an attacker exploits failed name resolution over local multicast.
An attacker listens for multicast queries and immediately responds with spoofed unicast answers claiming to be the requested resource.
This confirms LLMNR poisoning as the initial access indicator.
3
Trace the subsequent protocol activity triggered by the spoofed name resolution.
Victim systems connect to the attacker's IP over SMB (TCP 445) and attempt authentication, transmitting NTLMv2 hashes to the rogue host.
This establishes the secondary credential harvesting indicator.

Key Concept

LLMNR/NBT-NS Poisoning and Credential Harvesting Indicators
Estimated Time:1m 30s
Rate this question

Topics

Network and Wireless Attack Indicators

More questions from this topic