Examkin

Soru

Zorluk: OrtaNetwork and Wireless Attack Indicators

A network administrator receives alerts regarding unauthorized network configuration changes on several enterprise workstations. Inspection of client packet captures reveals that the affected systems received IP configuration leases containing an unexpected primary DNS server address (10.0.50.25410.0.50.254) and default gateway, originating from an unrecognized device sending unauthorized DHCPACK messages on the local subnet. Which of the following attacks is indicated by these symptoms?

  1. Rogue DHCP server deploymentCevap
  2. B
    ARP cache poisoning
  3. C
    MAC address flooding
  4. D
    DNS cache poisoning

Cevap

Rogue DHCP server deployment
The correct answer is rogue DHCP server deployment. When an unauthorized device on a subnet responds to client DHCP broadcasts with DHCPACK messages containing malicious network parameters (such as an attacker-controlled default gateway or rogue DNS server), it misdirects network traffic for on-path interception.

Adım Adım Çözüm

1
Analyze the observed network activity and packet logs
Workstations are accepting new IP lease configurations containing unauthorized default gateway and DNS settings delivered via DHCPACK messages from an rogue local system.
Identifying the specific protocol and frame types isolates the service responsible for the anomaly.
2
Differentiate protocol spoofing mechanisms
DHCPACK messages carrying modified Option 3 (default gateway) and Option 6 (DNS server) settings confirm that an unauthorized DHCP server is competing with the legitimate network server.
DHCP is the standard protocol used to assign network settings, DNS servers, and routing gateways dynamically to connecting clients.
3
Select the matching attack classification
An unauthorized system answering client requests with malicious network parameters is classified as a rogue DHCP server attack.
The observed behavior aligns precisely with the technical signature of a rogue DHCP deployment designed to perform on-path traffic interception.

Anahtar Kavram

Rogue DHCP Server Indicators
Bu soruyu puanla

Konular

Network and Wireless Attack Indicators

Bu konudan daha fazla soru