Examkin

Soru

Zorluk: Çok zorCommon Network Attack Types and Vectors

During a security incident investigation on an enterprise local area network, network monitoring tools record a high volume of traffic originating from a host connected to switch port Fa0/12. Analysis reveals that the host flooded the switch with thousands of Ethernet frames containing randomized source MAC addresses, completely filling the switch Content Addressable Memory (CAM) table. Immediately following this flood, analysts observe that confidential unicast traffic intended for a specific internal database server is being replicated and sent out all active ports on the VLAN. Which of the following statements accurately describe the underlying mechanics of this network attack and the appropriate Layer 2 countermeasures? (Select TWO)

  1. The attack forces the switch into a fail-open state (unicast flooding), causing it to act like a hub and broadcast unicast frames across all ports in the VLAN when destination MAC addresses cannot be found in the CAM table.Cevap
  2. B
    The adversary successfully modified internal authoritative DNS AAAA records, causing client workstations to resolve server hostnames directly to the attacker's IPv6 address.
  3. Configuring Port Security on switch interfaces to limit the maximum number of learned MAC addresses and specify violation actions effectively prevents MAC flooding attacks.Cevap
  4. D
    The vulnerability occurs because TACACS+ protocol traffic uses unencrypted UDP port 23, allowing malicious actors to intercept and modify CAM table updates in transit.

Cevap

The attack forces the switch into a fail-open state (unicast flooding) due to CAM table exhaustion, and configuring Port Security with MAC address limits on switch interfaces is the primary Layer 2 mitigation.
The scenario describes a classic MAC flooding (CAM table exhaustion) attack. By overwhelming the switch with spoofed source MAC addresses, the switch's forwarding table fills up, causing it to fall back to flooding unknown unicast frames out all ports in the VLAN (behaving like a hub). Implementing Port Security on switch access ports restricts the allowed MAC addresses per port, preventing an attacker from injecting thousands of fake MAC addresses.

Adım Adım Çözüm

1
Analyze the observed attack mechanics described in the scenario.
The continuous generation of frames with randomized source MAC addresses exhausts the fixed storage space of the switch CAM table.
Once the CAM table is full, legitimate MAC-to-port bindings are flushed, and the switch cannot store new valid bindings.
2
Evaluate how a switch handles frames with destination MAC addresses missing from the CAM table.
The switch enters a fail-open condition known as unknown unicast flooding.
Because the switch cannot look up the destination port in its table, it floods unicast frames to every port in the same VLAN except the ingress port, allowing an attacker on any port to capture the traffic.
3
Identify the proper switch configuration control to mitigate this specific Layer 2 attack vector.
Port Security with strict MAC address limits effectively blocks MAC flooding.
Port Security bounds the number of MAC addresses learned on access ports (e.g., maximum of 1 or 2 MACs per port) and triggers a shutdown or restrict action if unknown MAC addresses are received.

Anahtar Kavram

MAC Flooding / CAM Table Exhaustion and Port Security Mitigation
Bu soruyu puanla

Konular

Common Network Attack Types and Vectors

Bu konudan daha fazla soru