Examkin

Soru

Zorluk: ZorKey Security Concepts, Threats, Vulnerabilities, and Mitigations

An enterprise network administrator is conducting a security risk assessment across the organization's infrastructure. Match each security incident description on the left to its appropriate technical mitigation control on the right.

  • An attacker uses botnets to flood an enterprise internet edge router with ICMP traffic, causing link saturation and preventing legitimate user access.Deployment of upstream traffic scrubbing, edge access control lists, and cloud-based DDoS mitigation services.
  • A rogue device connected to an unmonitored switch port rapidly transmits frames with randomized source MAC addresses to overflow the switch MAC lookup table.Implementation of Port Security with maximum MAC address limits and violation restrict/shutdown actions.
  • An external malicious actor executes an automated password-spraying script against an exposed network management portal to gain privileged access.Deployment of Multi-Factor Authentication (MFA) combined with rate-limiting and strong password lockout policies.
  • An unauthorized host on a shared VLAN captures cleartext management session traffic containing administrative credentials sent to network devices.Enforcement of SSHv2 for device management while disabling unencrypted legacy protocols like Telnet and HTTP.

Cevap

DDoS flood attacks pair with upstream DDoS mitigation and edge ACLs. MAC table flooding pairs with Port Security limits. Password-spraying attacks pair with Multi-Factor Authentication (MFA) and lockout policies. Cleartext credential sniffing pairs with SSHv2 enforcement.
Each attack vector targets a specific network plane or resource: DDoS targets bandwidth availability (mitigated via upstream filtering), CAM table flooding targets Layer 2 switch buffer resources (mitigated via Port Security limits), password spraying targets authentication mechanisms (mitigated via MFA/lockout policies), and cleartext sniffing targets data confidentiality (mitigated via SSHv2 encryption).

Adım Adım Çözüm

1
Analyze the attack mechanism in the first scenario (flooding edge router with ICMP traffic).
Identify this as a Distributed Denial of Service (DDoS) attack targeting network availability.
DDoS attacks require boundary defenses such as edge ACLs and upstream scrubbing services.
2
Analyze the attack mechanism in the second scenario (randomized source MAC frames filling switch table).
Identify this as a MAC address table (CAM table) overflow attack targeting Layer 2 switch operations.
Port Security enforces maximum MAC learning limits on access ports to block unauthorized MAC generation.
3
Analyze the attack mechanism in the third scenario (automated password-spraying script).
Identify this as a brute-force credential attack targeting authentication mechanisms.
MFA and account lockout rules prevent single factor password guessing from compromising accounts.
4
Analyze the attack mechanism in the fourth scenario (capturing cleartext management session traffic).
Identify this as an eavesdropping/sniffing vulnerability resulting from unencrypted management protocols.
SSHv2 provides cryptographic encryption and integrity checks for remote management, mitigating eavesdropping.

Anahtar Kavram

Key Security Concepts, Threats, Vulnerabilities, and Mitigations
Bu soruyu puanla

Konular

Key Security Concepts, Threats, Vulnerabilities, and Mitigations

Bu konudan daha fazla soru