Examkin

Soru

Zorluk: OrtaCommon Network Attack Types and Vectors

A network administrator at a branch office discovers that several newly connected workstation clients are receiving IP configuration parameters from an unauthorized scope outside the corporate network design. Analysis reveals that these clients were assigned a default gateway address belonging to an unknown laptop on the local segment, causing all outbound traffic from these clients to be intercepted. Which of the following attack types is being executed?

  1. Rogue DHCP server attackCevap
  2. B
    ARP poisoning attack
  3. C
    DNS AAAA record redirection
  4. D
    Telnet port forwarding exploit

Cevap

The attack described is a rogue DHCP server attack, as an unauthorized device is distributing network configurations and setting itself as the default gateway.
A rogue DHCP server intercepts client network deployment by answering DHCP client broadcasts with rogue IP parameters and specifying the attacker's machine as the default gateway, enabling on-path traffic eavesdropping.

Adım Adım Çözüm

1
Analyze the incident symptoms presented in the scenario.
Newly connected clients are receiving invalid IP subnet leases and an unauthorized default gateway pointing to an unknown host on the local segment.
Identifying how the malicious parameters were delivered pinpoints the service protocol involved.
2
Correlate the delivery vector with common network attack mechanisms.
The parameters (IP configuration and default gateway) are assigned during network initiation via DHCP. An unauthorized host responding to DHCPDISCOVER requests is operating as a rogue DHCP server.
Rogue DHCP servers exploit unauthenticated DHCP broadcast requests to provide clients with malicious default gateway setting for man-in-the-middle positioning.

Anahtar Kavram

Rogue DHCP Server Attack Vector
Tahmini Süre:1m 15s
Bu soruyu puanla

Konular

Common Network Attack Types and Vectors

Bu konudan daha fazla soru