Examkin

Question

Difficulty: MediumNetwork and Wireless Attack Indicators

During an enterprise security audit, an incident response team identifies four distinct technical indicators across wireless and wired network segments. Match each observed technical anomaly on the left to its corresponding attack classification on the right.

  • A continuous stream of 802.11 management frames containing reason code 7 sent to client MAC addresses, causing immediate wireless disconnection.Deauthentication Attack
  • Unsolicited ARP replies broadcasted across a subnet associating the default gateway IP address with an unauthorized host MAC address.ARP Poisoning
  • Spurious IPv6 Neighbor Advertisement frames claiming ownership of an existing router link-local address without prior Neighbor Solicitation.NDP Spoofing
  • An unauthorized access point broadcasting a corporate SSID with an elevated transmit power (+20 dBm+20\text{ dBm}) to force client reassociation.Evil Twin Attack

Answer

The technical anomalies match their respective attack categories based on protocol-specific indicators: 802.11 management deauth frames match Deauthentication Attack; unsolicited ARP responses match ARP Poisoning; unauthorized IPv6 Neighbor Advertisements match NDP Spoofing; and rogue APs broadcasting legitimate SSIDs match Evil Twin Attack.
Each technical log indicator aligns directly with its underlying protocol behavior: 802.11 management deauthentication frames force client disconnects (Deauthentication Attack); gratuitous ARP replies corrupt local ARP caches (ARP Poisoning); unsolicited ICMPv6 Neighbor Advertisements corrupt IPv6 neighbor caches (NDP Spoofing); and rogue APs broadcasting identical SSIDs with higher RF signal levels manipulate wireless roaming decisions (Evil Twin Attack).

Step-by-Step Solution

1
Analyze the 802.11 management frame anomaly with reason code 7.
Reason code 7 explicitly denotes explicit wireless disassociation/deauthentication requesting disconnect, matching Deauthentication Attack.
Deauthentication frames are unauthenticated in legacy 802.11 standards and used to force disconnects.
2
Examine the unsolicited ARP response packet capture.
Mapping the gateway IP to an unknown host MAC address manipulates the switch IPv4 neighbor cache, confirming ARP Poisoning.
ARP lacks authentication mechanisms, allowing malicious hosts to spoof mapping responses.
3
Evaluate the IPv6 Neighbor Advertisement anomaly.
NDP Neighbor Advertisements perform address resolution in IPv6 analogous to ARP in IPv4, making unsolicited NA broadcasts indicative of NDP Spoofing.
Without SEND (Secure Neighbor Discovery), NDP messages can be spoofed to divert IPv6 traffic.
4
Identify the rogue AP broadcasting the legitimate corporate SSID.
Mimicking a valid wireless network name with higher power output to trick station roaming algorithms matches the Evil Twin classification.
Wireless clients typically prefer APs with stronger RSSI operating under known SSIDs.

Key Concept

Network and Wireless Attack Indicators
Rate this question

Topics

Network and Wireless Attack Indicators

More questions from this topic