Examkin

Question

Difficulty: MediumNetwork and Wireless Attack Indicators

A network administrator receives alerts regarding unauthorized network configuration changes on several enterprise workstations. Inspection of client packet captures reveals that the affected systems received IP configuration leases containing an unexpected primary DNS server address (10.0.50.25410.0.50.254) and default gateway, originating from an unrecognized device sending unauthorized DHCPACK messages on the local subnet. Which of the following attacks is indicated by these symptoms?

  1. Rogue DHCP server deploymentAnswer
  2. B
    ARP cache poisoning
  3. C
    MAC address flooding
  4. D
    DNS cache poisoning

Answer

Rogue DHCP server deployment
The correct answer is rogue DHCP server deployment. When an unauthorized device on a subnet responds to client DHCP broadcasts with DHCPACK messages containing malicious network parameters (such as an attacker-controlled default gateway or rogue DNS server), it misdirects network traffic for on-path interception.

Step-by-Step Solution

1
Analyze the observed network activity and packet logs
Workstations are accepting new IP lease configurations containing unauthorized default gateway and DNS settings delivered via DHCPACK messages from an rogue local system.
Identifying the specific protocol and frame types isolates the service responsible for the anomaly.
2
Differentiate protocol spoofing mechanisms
DHCPACK messages carrying modified Option 3 (default gateway) and Option 6 (DNS server) settings confirm that an unauthorized DHCP server is competing with the legitimate network server.
DHCP is the standard protocol used to assign network settings, DNS servers, and routing gateways dynamically to connecting clients.
3
Select the matching attack classification
An unauthorized system answering client requests with malicious network parameters is classified as a rogue DHCP server attack.
The observed behavior aligns precisely with the technical signature of a rogue DHCP deployment designed to perform on-path traffic interception.

Key Concept

Rogue DHCP Server Indicators
Rate this question

Topics

Network and Wireless Attack Indicators

More questions from this topic