Examkin

Question

Difficulty: HardNetwork and Wireless Attack Indicators

Match each observed log signature or network artifact on the left with its corresponding attack classification on the right.

  • Packet captures reveal a rapid flood of DHCPDISCOVER requests originating from unique, randomly generated MAC addresses, resulting in scope depletion.DHCP Starvation Attack
  • Wireless capture logs show an rogue access point broadcasting 802.11 PROBE_RESP frames matching any SSID requested in nearby client probe requests.KARMA Wireless Attack
  • Proxy logs indicate incoming HTTP 302 Redirect responses to secure endpoints are stripped to plain HTTP before delivery to the client browser.SSL Stripping Attack
  • An Ethernet frame capture contains nested 802.1Q tags (VID10VID_{10} outer, VID20VID_{20} inner) transmitted over an access port attached to an autonegotiating switch interface.Double-Tagging VLAN Hopping

Answer

DHCP flood with random MAC addresses matches DHCP Starvation Attack; fake probe responses matching requested SSIDs match KARMA Wireless Attack; converting HTTPS redirects to cleartext HTTP matches SSL Stripping Attack; nested 802.1Q tags match Double-Tagging VLAN Hopping.
Each attack type directly corresponds to distinct frame and header characteristics: DHCP Starvation floods randomized MAC requests, KARMA answers client PNL probes dynamically, SSL Stripping downgrades HTTPS redirects to cleartext HTTP, and Double-Tagging uses nested 802.1Q headers to cross VLAN boundaries.

Step-by-Step Solution

1
Analyze the DHCP frame log showing high-frequency requests with randomized MAC addresses.
Identified as a resource exhaustion vector targeted at DHCP pools (DHCP Starvation Attack).
Spoofed MAC addresses consume all legitimate leases in the scope.
2
Analyze the 802.11 management frames showing PROBE_RESP matching client probe requests.
Identified as a specialized rogue AP probe response manipulation technique (KARMA Attack).
KARMA actively listens to clients' preferred network lists (PNL) and mimics whatever SSID they seek.
3
Examine web traffic proxy logs modifying HTTP 302 HTTPS redirection headers to HTTP.
Identified as cleartext transport protocol manipulation (SSL Stripping Attack).
The attacker intercepts HTTP-to-HTTPS upgrades to maintain visibility over unencrypted traffic.
4
Inspect Ethernet frame headers carrying double 802.1Q VLAN identifiers.
Identified as encapsulation exploitation across trunking switch ports (Double-Tagging VLAN Hopping).
The first switch strips the outer tag matching the native VLAN, allowing the frame to be forwarded to the inner tagged VLAN without routing.

Key Concept

Network and Wireless Attack Indicators
Rate this question

Topics

Network and Wireless Attack Indicators

More questions from this topic