Describe TCP/IP Protocol Vulnerabilities 100-160 Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A security analyst is investigating a series of attacks where users are redirected to malicious websites. The analyst suspects DNS cache poisoning. The company uses a recursive DNS server that forwards queries to external resolvers. Which additional control would best help detect and mitigate DNS cache poisoning?

   • ADisable recursion on the DNS server
   • BEnable DNSSEC validation on the recursive resolver
   • CIncrease the DNS TTL values
   • DUse a larger DNS cache to store more entries
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which DNS attack involves an attacker inserting false records into a DNS resolver's cache, causing users to be directed to malicious websites?

   • ATCP sequence prediction
   • BDNS cache poisoning
   • CARP spoofing
   • DDHCP starvation
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A security analyst notices a sudden spike in incomplete TCP connections to the company's web server. The server's connection table is filling up, and legitimate users are experiencing timeouts. The analyst suspects a SYN flood. Which immediate mitigation would most effectively reduce the impact while preserving legitimate access?

   • AEnable SYN cookies on the server's operating system
   • BIncrease the server's TCP timeout value so half-open connections stay longer
   • CBlock all incoming TCP traffic on port 80
   • DDisable TCP timestamps on the server
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A network administrator is investigating a security incident where several clients received IP configurations that directed them to a malicious DNS server. The administrator finds that a device on the network is responding to DHCP discovery messages before the legitimate DHCP server. Which two protocol vulnerabilities are being exploited?

   • ADHCP leases are never renewed, and DNS cache poisoning can be used to redirect clients.
   • BDHCP clients accept the first offer they receive without authentication, and ARP can be used to verify the DHCP server's identity.
   • CDHCP uses a three-way handshake that can be hijacked, and ICMP redirects can be used to reroute DHCP traffic.
   • DDHCP offers are encrypted, and ARP spoofing can be used to redirect the DHCP server's traffic.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Which ICMP-based attack sends a large number of echo request packets to a target to consume its resources and bandwidth?

   • ADHCP starvation
   • BARP poisoning
   • CPing flood
   • DSYN flood
   Reveal Solution Discussion Select an answer first