Examkin

Soru

Zorluk: KolayCommon Network Attack Types and Vectors

An organization's network monitoring tool alerts administrators to an overwhelming volume of unsolicited UDP responses originating from public DNS servers, all targeted at a single internal web server. Investigation reveals that an external attacker sent small DNS requests with a spoofed source IP address corresponding to the target server. Which of the following network attack vectors is being executed?

  1. A
    DNS cache poisoning
  2. B
    ARP poisoning
  3. DNS amplification attackCevap
  4. D
    Port scanning

Cevap

The attack vector being executed is a DNS amplification attack.
A DNS amplification attack occurs when an attacker sends small DNS queries with a spoofed source IP address (belonging to the victim) to open recursive DNS resolvers. The resolvers respond with large payload answers to the victim's address, overwhelming the target's network bandwidth and causing a Denial of Service.

Adım Adım Çözüm

1
Analyze the reported traffic pattern.
Unsolicited, high-volume UDP traffic is arriving from public DNS servers directed at a specific internal IP address.
Identifying the flow of traffic helps distinguish volumetric DDoS reflection attacks from local or targeted spoofing attacks.
2
Determine the attack technique based on the spoofed source IP mechanism.
Small requests were sent with the victim's IP as the return address, leveraging recursive resolvers to generate larger response payloads.
This reflective amplification mechanism is the defining characteristic of a DNS amplification DDoS attack.

Anahtar Kavram

DNS Amplification Attack
Tahmini Süre:45s
Bu soruyu puanla

Konular

Common Network Attack Types and Vectors

Bu konudan daha fazla soru