Examkin

Question

Difficulty: MediumNetwork and Wireless Attack Indicators

A security analyst is evaluating packet captures and log entries following a network intrusion alert. Match each observed technical indicator to its corresponding network or wireless attack classification.

  • Radio frequency frames captured with rapidly repeating 24-bit Initialization Vector (IV) values across a WEP-encrypted network segment.IV Attack
  • Unsolicited IPv6 Router Advertisement (RA) messages broadcasting fraudulent prefix information to reconfigure client default gateways.Rogue RA Attack
  • Inbound DNS response packets carrying forged IP addresses arriving before legitimate authoritative replies with matching transaction IDs.DNS Poisoning
  • Layer 2 Ethernet frames encapsulating two distinct 802.1Q tags to traverse unauthorized switch Virtual Local Area Networks.VLAN Hopping

Answer

Repeating 24-bit IV values correspond to IV Attack; unsolicited IPv6 Router Advertisements correspond to Rogue RA Attack; forged DNS response packets arriving early correspond to DNS Poisoning; Ethernet frames with double 802.1Q headers correspond to VLAN Hopping.
The technical indicators specifically map to their corresponding attack mechanisms: repeating 24-bit IVs indicate an IV attack against WEP; unauthenticated IPv6 ICMPv6 router messages represent a Rogue RA attack; premature forged DNS replies represent DNS poisoning; and double 802.1Q header encapsulation represents VLAN hopping.

Step-by-Step Solution

1
Analyze the wireless packet capture indicator showing repeating initialization vectors.
Identify that reused 24-bit IVs under WEP encryption facilitate key mathematical derivation.
WEP uses small 24-bit IVs; frequent reuse enables keystream recovery in an IV attack.
2
Examine the network layer broadcast log showing unsolicited IPv6 Router Advertisements.
Determine that unauthorized RA broadcasts alter host routing paths.
Rogue RA attacks exploit IPv6 stateless address autoconfiguration (SLAAC) to redirect traffic.
3
Evaluate the application layer network log showing early DNS responses.
Recognize that forged DNS answers supplied ahead of valid authoritative resolvers corrupt cache records.
Race conditions in DNS resolution allow attackers to poison resolver caches with malicious IP mappings.
4
Inspect the data link layer encapsulation log showing multiple VLAN tags.
Identify that double 802.1Q tagging allows traffic to cross VLAN boundaries bypassing switch isolation.
Switches processing double-tagged frames strip the first tag and forward the frame onto the inner VLAN tag.

Key Concept

Network and Wireless Attack Indicators
Rate this question

Topics

Network and Wireless Attack Indicators

More questions from this topic