Examkin

Question

Difficulty: MediumNetwork and Wireless Attack Indicators

A security analyst reviews packet capture metrics following reports of intermittent traffic manipulation on a corporate wireless network. The packet capture reveals unexpected network protocol behavior during client IP address assignment. Which TWO of the following indicators specifically point to a rogue DHCP server attack on the network? (Select TWO.)

  1. Multiple DHCP OFFER packets originating from an unauthorized MAC address containing an unapproved default gateway IPAnswer
  2. Duplicate DHCP ACK responses observed on the subnet assigning client IP configurations outside the authorized scope poolAnswer
  3. C
    A rapid flood of management disassociation frames directing wireless clients to disconnect and re-authenticate
  4. D
    Repeated transmission of 802.11 Initialization Vector (IV) values within captured encrypted wireless frames

Answer

The presence of a rogue DHCP server is confirmed by unauthorized DHCP OFFER packets containing an unapproved default gateway address and duplicate DHCP ACK responses assigning IP configurations outside the legitimate network scope.
A rogue DHCP server operates by broadcasting unauthorized DHCP OFFER and DHCP ACK packets in response to client DHCP DISCOVER requests. These unauthorized packets contain modified IP settings, such as an unapproved default gateway address or DNS server IP, enabling the attacker to perform on-path network interception.

Step-by-Step Solution

1
Analyze the observed network protocol behavior described in the scenario
Identified anomalous IP address assignment traffic during client network initialization.
DHCP attacks target the automated address allocation process on local subnets.
2
Evaluate the specific packet types and attributes characteristic of rogue DHCP servers
Rogue DHCP servers race against legitimate DHCP servers to respond to client DISCOVER messages with unauthorized DHCP OFFER and ACK packets.
By supplying invalid gateway or DNS settings, the attacker establishes an on-path position for interception.
3
Differentiate rogue DHCP indicators from unrelated wireless attacks
Disassociation frame floods represent wireless DoS/deauthentication attacks, while IV reuse represents cryptographic key cracking attempts.
Accurate incident diagnosis requires matching protocol anomalies directly to the underlying threat vector.

Key Concept

Rogue DHCP Server Attack Indicators
Rate this question

Topics

Network and Wireless Attack Indicators

More questions from this topic