A network security administrator detects anomalous network activity where a switch is broadcasting unicast frames to all active switch ports, enabling an unauthorized user to capture sensitive network traffic. Investigation reveals that a connected device transmitted tens of thousands of frames with distinct, randomly generated source physical addresses within a few seconds. Which of the following statements accurately characterize the attack vector taking place and its primary mitigation method? (Select TWO)
- The threat actor is executing a MAC flooding attack designed to exhaust the switch's Content Addressable Memory (CAM) table capacity.Cevap
- BThe incident is a DNS cache poisoning attack intended to corrupt hostname-to-IP resolution on the local gateway.
- Implementing Port Security on switch access interfaces effectively mitigates this attack by limiting the number of learned MAC addresses.Cevap
- DModifying internal DNS CNAME records prevents the switch forwarding table from entering fail-open broadcast behavior.
Cevap
The incident is a MAC flooding attack aimed at overflowing the switch's CAM table, which can be mitigated by configuring Port Security on switch ports.
A MAC flooding attack sends numerous frames containing invalid source MAC addresses to fill the switch's CAM table. Once full, the switch enters fail-open mode, broadcasting all traffic like a hub and allowing unauthorized packet capture. Port Security directly defends against this by enforcing limits on MAC address learning per port.
Adım Adım Çözüm
Anahtar Kavram
MAC Flooding and Port Security
Tahmini Süre:1m 30s