Examkin

Soru

Zorluk: OrtaNetwork and Wireless Attack Indicators

A security analyst is investigating network and wireless security alerts recorded in an enterprise environment. Match each observed technical attack indicator on the left with its corresponding attack classification on the right.

  • System logs show an influx of unauthorized ICMPv6 Router Advertisement (RA) packets assigning rogue default gateway IP addresses to local hosts.Rogue IPv6 Router Advertisement Attack
  • Packet captures reveal continuous 802.11 disassociation frames broadcast with a spoofed access point BSSID, forcing wireless clients to disconnect.Wireless Disassociation Attack
  • Network security monitoring detects unsolicited ARP reply packets updating switch host tables with mismatched IP-to-MAC address bindings for the internal gateway.ARP Cache Poisoning
  • A RF monitoring sensor alerts on a severe rise in the 5 GHz noise floor, causing total carrier sense degradation and complete loss of frame transmission.Radio Frequency (RF) Jamming

Cevap

ICMPv6 Router Advertisement packets match Rogue IPv6 Router Advertisement Attack; continuous 802.11 disassociation management frames match Wireless Disassociation Attack; unsolicited ARP reply packets with mismatched bindings match ARP Cache Poisoning; high RF noise floor causing CSMA/CA failure matches Radio Frequency (RF) Jamming.
Each indicator uniquely aligns with its layer and protocol signature: ICMPv6 RA frames reflect IPv6 routing manipulation; spoofed 802.11 management frames indicate disassociation; forged ARP replies indicate ARP poisoning; and elevated channel noise indicates RF jamming.

Adım Adım Çözüm

1
Analyze the ICMPv6 RA indicator.
ICMPv6 Router Advertisements configure SLAAC/gateway settings; rogue messages indicate a IPv6 RA attack attempting on-path traffic redirection.
ICMPv6 Type 134 packets are specifically used by IPv6 routers to advertise gateway capabilities.
2
Analyze the 802.11 disassociation frame indicator.
Disassociation frames are 802.11 management packets that terminate client association with a WAP.
Forged management frames exploiting lack of Protected Management Frames (802.11w) characterize disassociation attacks.
3
Analyze the ARP packet indicator.
Unsolicited ARP responses overwrite local ARP caches with malicious layer 2 address maps.
Gratuitous ARP replies modified to point the default gateway IP to an unauthorized MAC address define ARP cache poisoning.
4
Analyze the RF noise floor indicator.
Physical layer noise blocking Wi-Fi channels represents deliberate radio frequency interference.
Jamming operates at Layer 1 by raising the noise floor above usable signal-to-noise ratio levels.

Anahtar Kavram

Identifying technical indicators and signatures of network layer and wireless attacks.
Bu soruyu puanla

Konular

Network and Wireless Attack Indicators

Bu konudan daha fazla soru