Examkin

Question

Difficulty: MediumNetwork and Wireless Attack Indicators

During a threat hunting exercise, a security analyst inspects packet captures from an internal network switch interface. The analyst notes Ethernet frames containing nested 802.1Q encapsulation headers, where the outer VLAN tag matches the native VLAN ID of the trunk interface (VLAN 20) and the inner VLAN tag targets an isolated database subnet (VLAN 100). Which of the following network attacks do these frame characteristics indicate?

  1. VLAN hopping via double taggingAnswer
  2. B
    ARP cache poisoning
  3. C
    MAC address spoofing
  4. D
    DNS cache poisoning

Answer

VLAN hopping via double tagging
The correct answer is VLAN hopping via double tagging. Double tagging takes advantage of switches stripping the outer 802.1Q tag when traffic belongs to the native VLAN of a trunk link. When stripped, the remaining inner tag is processed by downstream switches as legitimate traffic destined for the specified secondary VLAN, bypassing standard VLAN isolation controls.

Step-by-Step Solution

1
Analyze the packet capture details described in the stem.
Identified two 802.1Q headers inside the Ethernet frames (outer tag = native VLAN 20, inner tag = target VLAN 100).
Observing multiple VLAN headers (nested 802.1Q tags) is the key indicator of a double-tagging attack vector.
2
Evaluate the mechanism of switch processing for native VLAN trunk traffic.
The first switch strips the matching native VLAN outer tag and transmits the frame out the trunk link without adding a new tag, exposing the inner tag.
The second switch inspects the inner tag (VLAN 100) and routes/forwards the frame directly into the isolated target segment.
3
Correlate packet characteristics to the correct attack classification.
The indicator strictly matches VLAN hopping via double tagging.
Double tagging allows unidirectional frame delivery across VLAN boundaries without passing through a router.

Key Concept

VLAN Hopping (802.1Q Double Tagging)
Rate this question

Topics

Network and Wireless Attack Indicators

More questions from this topic