Examkin

Soru

Zorluk: OrtaCommon Network Attack Types and Vectors

A security technician is investigating a multi-stage incident on an enterprise network segment. Packet logs reveal that an unauthorized internal host transmitted forged Gratuitous ARP messages to map the IP address of the default gateway to its own physical address. Simultaneously, internal users reported that entering legitimate domain names into their web browsers redirected them to a suspicious external IP address hosted on an unauthorized server. Which of the following attack types were executed during this incident? (Select TWO.)

  1. ARP PoisoningCevap
  2. DNS PoisoningCevap
  3. C
    MAC Flooding
  4. D
    VLAN Hopping

Cevap

The attack types executed in this scenario are ARP Poisoning and DNS Poisoning.
ARP Poisoning occurs when forged ARP messages alter the MAC-to-IP mapping on local hosts, misdirecting traffic intended for the gateway. DNS Poisoning alters domain name resolution data so that queries for legitimate web services return malicious IP addresses.

Adım Adım Çözüm

1
Analyze the first incident symptom
Identified forged Gratuitous ARP packets remapping the default gateway's IP to an attacker's MAC address.
This behavior directly defines ARP poisoning (or ARP spoofing), enabling man-in-the-middle positioning on Layer 2.
2
Analyze the second incident symptom
Identified domain name queries resolving to an unauthorized destination IP address.
Altering or spoofing name resolution responses to redirect users to unauthorized web servers defines DNS cache poisoning/spoofing.

Anahtar Kavram

Identifying Man-in-the-Middle and redirection attack vectors based on network signatures
Bu soruyu puanla

Konular

Common Network Attack Types and Vectors

Bu konudan daha fazla soru