Examkin

Soru

Zorluk: ZorCommon Network Attack Types and Vectors

An enterprise network analyst observes that unicast frames intended exclusively for a secure file server are suddenly being received by all host interfaces connected to the same switch module. A review of the switch diagnostics reveals that the switch's MAC address table is entirely saturated with thousands of randomized, fake source MAC addresses. As a result, new frame forwarding defaults to broadcasting across all ports within the VLAN. Which of the following attack types has occurred, and what is its operational objective?

  1. MAC flooding, which forces the switch into a fail-open state to allow unauthorized packet sniffing of unicast trafficCevap
  2. B
    ARP cache poisoning, which broadcasts malicious address resolution responses to corrupt host-level IP-to-MAC mappings
  3. C
    DNS cache poisoning, which alters record mappings on the local domain name server to redirect traffic to an unauthorized IP address
  4. D
    Port scanning, which sends sequential TCP probes to discover open application transport services across host interfaces

Cevap

MAC flooding, which forces the switch into a fail-open state to allow unauthorized packet sniffing of unicast traffic
The correct answer identifies MAC flooding. During a MAC flooding attack, an attacker generates rapid traffic containing thousands of randomized source MAC addresses. This exhausts the storage capacity of the switch's Content Addressable Memory (CAM) table. Once full, the switch cannot learn legitimate MAC addresses and enters a fail-open operational mode, broadcasting incoming unicast frames to every active port in the VLAN. Threat actors use this vector to transform switched networks into shared media to execute packet sniffing.

Adım Adım Çözüm

1
Analyze the observed network symptom
Unicast traffic intended for a single destination host is being broadcast to all ports across the switch segment.
This indicates that the Layer 2 switch can no longer locate destination MAC addresses in its dynamic forwarding database.
2
Examine switch diagnostics and state change
The switch's Content Addressable Memory (CAM) table is exhausted due to thousands of randomized source MAC addresses.
When a switch's CAM table reaches maximum capacity, it falls back to a fail-open mode where unknown unicast traffic is flooded out every port within the VLAN.
3
Correlate symptoms with known attack vectors
This scenario matches a MAC flooding (CAM table overflow) attack designed to facilitate passive packet sniffing.
By converting switch behavior into hub-like broadcasting, an attacker connected to any switch port can capture sensitive frames intended for other hosts.

Anahtar Kavram

MAC Flooding / CAM Table Overflow
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Common Network Attack Types and Vectors

Bu konudan daha fazla soru