A network security engineer investigates an incident where internal users on VLAN 20 report unexpected SSL/TLS certificate warnings when accessing enterprise web resources. Analysis of packet captures and wireless sensor logs reveals anomalous network frames and suspicious radio frequency traffic around the perimeter. Which of the following technical indicators collectively confirm the simultaneous presence of an ARP poisoning on-path attack and a rogue wireless access point attempt? (Select TWO.)
- Unsolicited ARP reply packets broadcasting a mapping of the default gateway IP address to an unrecognized media access control (MAC) address.Answer
- 802.11 beacon frames broadcasting the corporate Service Set Identifier (SSID) from a previously uncataloged basic service set identifier (BSSID) on an unauthorized channel with higher relative signal strength.Answer
- CA high volume of 802.11 Management Disassociation frames sent with a spoofed access point MAC address to force clients into downgrading their authentication protocol to WEP.
- DRepeated ICMP Type 3 (Destination Unreachable) messages generated by the core switch to redirect client default gateway traffic toward a honeynet subnet.
Answer
The correct indicators are unsolicited ARP reply packets mapping the gateway IP to an unknown MAC address, and 802.11 beacon frames broadcasting the corporate SSID from an uncataloged BSSID on an unauthorized channel.
The combination of unsolicited ARP replies (spoofing the default gateway MAC address) and unauthorized 802.11 beacon frames (broadcasting the corporate SSID from an unknown BSSID with strong signal) explicitly confirms an active ARP poisoning attempt coupled with a rogue wireless access point deployment.
Step-by-Step Solution
Key Concept
Identifying indicators of ARP cache poisoning and rogue wireless access points (Evil Twin)