Describe TCP/IP Protocol Vulnerabilities 100-160 Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A company is migrating its internal web application from HTTP to HTTPS. The security team is also concerned about DNS spoofing and ARP spoofing on the internal network. The application is accessed by employees from their workstations. Which combination of controls provides the most comprehensive protection?

   • AUse a VPN for all internal traffic and implement DNS over HTTPS on the workstations.
   • BEnable port security and use static ARP entries on all workstations.
   • CDeploy a web application firewall and use a public DNS resolver.
   • DEnforce HTTPS with HSTS, implement DNSSEC on the internal DNS server, and enable Dynamic ARP Inspection (DAI) on the switches.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security analyst is reviewing network traffic and sees a large number of UDP packets sent to a single destination IP on port 53. The packets have varying source IP addresses, and the responses are larger than the requests. The analyst also notices that the destination IP is a public DNS server. Which two protocol characteristics are being exploited?

   • AICMP echo requests are being used to amplify the attack, and DNS cache poisoning is redirecting traffic.
   • BUDP does not require a handshake, and DNS responses can be larger than queries, enabling amplification.
   • CARP spoofing is being used to redirect traffic, and DHCP is assigning malicious DNS servers.
   • DTCP's three-way handshake is being used to establish a connection, and DNS queries are always sent over TCP.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A network administrator is investigating a DDoS attack where the company's firewall is overwhelmed by a flood of ICMP echo requests. The source IP addresses are all different and appear to be legitimate. The administrator also notices that the firewall's connection table is full of TCP SYN packets. Which two attack types are being combined?

   • AA smurf attack using ICMP and a DNS amplification attack using UDP.
   • BA DHCP starvation attack and an HTTP flood.
   • CA UDP flood and an ARP spoofing attack.
   • DA ping flood using ICMP and a SYN flood using TCP.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A network engineer is troubleshooting a DDoS attack where the company's router is overwhelmed by a flood of ICMP echo requests. The source IP addresses in the packets are all different and appear to be legitimate IP addresses from various networks. The engineer suspects a smurf attack. Which two protocol characteristics are being exploited?

   • AICMP echo requests can be sent to a broadcast address, and the source address can be spoofed to be the victim's IP.
   • BICMP is connection-oriented and requires a handshake, and TCP SYN packets can be used to amplify the attack.
   • CICMP timestamp requests can be used to map the network, and DHCP can be used to assign spoofed addresses.
   • DICMP redirect messages can alter routing tables, and UDP amplification can be used to increase traffic volume.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A network administrator is troubleshooting intermittent connectivity issues. Users report that they sometimes get an IP address that is not in the company's DHCP scope, and they cannot reach the internet. The administrator suspects a rogue DHCP server. Which mitigation is most effective?

   • AEnable ARP inspection on the switches
   • BEnable DHCP snooping on the switches
   • CDisable DHCP and use static IP addresses for all clients
   • DConfigure all clients to use a specific DNS server
   Reveal Solution Discussion Select an answer first