Examkin

Question

Difficulty: MediumNetwork and Wireless Attack Indicators

Match each observed network or wireless technical indicator on the left with its corresponding attack classification on the right.

  • Unsolicited ARP replies mapping multiple internal IP addresses to a single gateway MAC address.ARP Poisoning
  • High volume of EAPOL-Start frames continuously sent to an access point, exhausting RADIUS server resources.Wireless EAPOL Flooding
  • DNS query responses returning low TTL values (TTL=1sTTL = 1s) that rapidly rotate resolved IP addresses to evasive infrastructure.DNS Fast-Flux
  • Wireless WIPS alert showing a rogue access point mimicking an enterprise SSID with a stronger signal and different BSSID.Evil Twin

Answer

Unsolicited ARP replies map to ARP Poisoning; EAPOL-Start frame volume maps to Wireless EAPOL Flooding; Low TTL DNS response rotation maps to DNS Fast-Flux; Rogue AP mimicking enterprise SSID maps to Evil Twin.
Each observed technical indicator uniquely corresponds to its underlying attack vector: ARP poisoning alters Layer 2 mapping, EAPOL flooding targets 802.1X authentication state, DNS fast-flux rotates domain IP resolution with brief TTLs to evade IP blocking, and an Evil Twin spoofs wireless ESSID credentials.

Step-by-Step Solution

1
Analyze the Layer 2 traffic pattern of unsolicited ARP replies mapping multiple IPs to one MAC address.
Identified as ARP Poisoning/Spoofing.
Attacker is poisoning IP-to-MAC resolution tables on local hosts to intercept network traffic.
2
Analyze the wireless 802.1X authentication telemetry showing excessive EAPOL-Start frames.
Identified as Wireless EAPOL Flooding.
Generating constant authentication requests exhausts backend authentication resources.
3
Examine DNS resolution behavior exhibiting extremely short TTLs and constantly changing IP addresses.
Identified as DNS Fast-Flux.
Fast-flux DNS dynamically changes A records to hide malicious hosting infrastructure behind compromised proxies.
4
Evaluate the WIPS alert describing an unauthorized AP broadcasting a corporate network name with a modified BSSID and high power.
Identified as an Evil Twin attack.
Evil Twins attempt to trick wireless clients into auto-associating with an attacker-controlled access point.

Key Concept

Network and Wireless Attack Indicators
Estimated Time:1m 30s
Rate this question

Topics

Network and Wireless Attack Indicators

More questions from this topic