Examkin

Soru

Zorluk: KolayNetwork and Wireless Attack Indicators

A network security administrator monitoring enterprise switch logs notices that a single Media Access Control (MAC) address is rapidly alternating between two different physical switch ports. This constant port-flapping anomaly is causing frame misdirection across the local subnet. Which of the following attack types is most likely occurring?

  1. MAC spoofingCevap
  2. B
    ARP poisoning
  3. C
    DNS cache poisoning
  4. D
    Radio frequency jamming

Cevap

The attack indicated by the rapid alternation of a single MAC address across multiple switch ports is MAC spoofing.
MAC spoofing occurs when an attacker modifies their network interface MAC address to mirror an authorized device. Transmitting traffic from two devices using identical MAC addresses forces the network switch to continuously rebind the MAC address to different ports, generating port-flapping indicators in syslog.

Adım Adım Çözüm

1
Analyze the observed log indicator.
Identified MAC address table flapping, where a single physical MAC address is learned on two separate switch ports in rapid succession.
Ethernet switches dynamically map learned source MAC addresses to specific ingress ports in their forwarding tables.
2
Match the indicator to the corresponding Layer 2 network attack.
Duplicate MAC addresses active on separate ports cause the switch to constantly overwrite port assignments for that address.
This behavior directly points to a MAC spoofing scenario where an attacker duplicates an authorized machine's MAC address.

Anahtar Kavram

MAC Spoofing Indicators
Tahmini Süre:45s
Bu soruyu puanla

Konular

Network and Wireless Attack Indicators

Bu konudan daha fazla soru