Examkin

Soru

Zorluk: KolayCommon Network Attack Types and Vectors

A network administrator notices that local endpoint traffic intended for the default gateway is being redirected to an unauthorized workstation. Packet captures reveal that the unauthorized workstation is repeatedly sending unsolicited gratuitous ARP replies associating the default gateway's IP address with its own MAC address. Which of the following attack types is occurring?

  1. ARP poisoningCevap
  2. B
    DNS cache poisoning
  3. C
    DNS AAAA record spoofing
  4. D
    Port 22 SSH relay attack

Cevap

ARP poisoning
ARP poisoning involves broadcasting forged ARP response messages on a local network to link an attacker's MAC address with a legitimate IP address (such as the default gateway). This redirects local subnet traffic through the attacker's computer.

Adım Adım Çözüm

1
Analyze the reported network anomaly and protocol traffic
The packet capture identifies unsolicited gratuitous ARP replies mapping a gateway IP to an unauthorized MAC address.
Address Resolution Protocol (ARP) maps Layer 3 IPv4 addresses to Layer 2 MAC hardware addresses on local Ethernet subnets.
2
Determine the attack vector based on the protocol behavior
Spoofing ARP replies to intercept local traffic is known as ARP poisoning (or ARP spoofing).
By corrupting the ARP tables of neighboring hosts, the attacker positions themselves on-path for intercepted network traffic.

Anahtar Kavram

Address Resolution Protocol (ARP) Poisoning
Bu soruyu puanla

Konular

Common Network Attack Types and Vectors

Bu konudan daha fazla soru