Examkin

Soru

Zorluk: Çok zorKey Security Concepts, Threats, Vulnerabilities, and Mitigations

A network security architect is reviewing threat vectors and host-level network attacks targeting a corporate access layer switch. The audit identifies that an attacker connected to an untrusted port successfully performed ARP poisoning to intercept traffic between local hosts and launched a rogue DHCP server to distribute malicious default gateway addresses to clients. Which two mitigation controls directly address these specific security vulnerabilities? (Select two.)

  1. Enable Dynamic ARP Inspection on untrusted access ports to validate ARP request and reply packets against the DHCP snooping binding database.Cevap
  2. B
    Enable PortFast on inter-switch trunk links to instantly block malicious ARP packet floods and prevent network reconnaissance scans.
  3. Implement DHCP Snooping across access switches and configure uplink interfaces connected to authorized network servers as trusted ports.Cevap
  4. D
    Deploy RADIUS authentication to encrypt the entire IP packet payload during authorization and command accounting transactions.

Cevap

Enabling Dynamic ARP Inspection on untrusted access ports and implementing DHCP Snooping with trusted uplink interfaces directly mitigate ARP poisoning and rogue DHCP server attacks.
Dynamic ARP Inspection prevents ARP spoofing by intercepting ARP traffic on untrusted interfaces and verifying IP-to-MAC bindings against the DHCP snooping database. DHCP Snooping prevents unauthorized hosts from acting as DHCP servers by dropping server messages on untrusted ports while allowing legitimate leases through trusted ports.

Adım Adım Çözüm

1
Analyze the reported attack vectors.
Identified two primary Layer 2 threats: ARP poisoning (Man-in-the-Middle) and rogue DHCP server insertion.
Selection of security controls must correspond specifically to validating address resolution and filtering unauthorized IP address assignment.
2
Evaluate controls for ARP poisoning mitigation.
Dynamic ARP Inspection (DAI) inspects incoming ARP packets on untrusted ports and matches their source IP/MAC address against legitimate entries in the DHCP snooping binding database.
Invalid ARP packets with spoofed IP-to-MAC bindings are dropped, blocking the Man-in-the-Middle vector.
3
Evaluate controls for rogue DHCP server mitigation.
DHCP Snooping filters unauthorized DHCP server traffic by defining trusted ports for legitimate servers and untrusted ports for end-user switchports.
DHCP server messages such as OFFER or ACK originating from untrusted ports are discarded.

Anahtar Kavram

Layer 2 Threat Mitigation Mechanisms: Dynamic ARP Inspection (DAI) and DHCP Snooping
Bu soruyu puanla

Konular

Key Security Concepts, Threats, Vulnerabilities, and Mitigations

Bu konudan daha fazla soru