Describe TCP/IP Protocol Vulnerabilities 100-160 Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A company's web application allows users to log in over HTTP. A network administrator is concerned about credential theft and session hijacking. The administrator decides to implement HTTPS, but the application also uses a custom DNS name that is not yet configured with DNSSEC. Which two vulnerabilities is the administrator addressing?

   • AHTTP does not support encryption, and DNS queries are always encrypted when using HTTPS.
   • BHTTP uses UDP which is connectionless, and DNS cache poisoning can be prevented by using HTTPS.
   • CHTTP uses a three-way handshake that can be hijacked, and DNS amplification can be used to overwhelm the server.
   • DHTTP transmits credentials in plaintext, and DNS without DNSSEC can be spoofed to redirect users to a malicious server.
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   Which TCP attack exploits the three-way handshake by sending many connection requests without completing the handshake, exhausting the server's connection queue?

   • AUDP amplification
   • BARP spoofing
   • CSYN flood
   • DTCP sequence prediction
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A network administrator wants to prevent ARP spoofing on a switched network. The switches support DHCP snooping and Dynamic ARP Inspection (DAI). Which configuration is the most effective?

   • ADisable ARP on the network
   • BConfigure static ARP entries on all hosts
   • CEnable port security with sticky MAC addresses
   • DEnable DHCP snooping and DAI on all access ports
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   Which attack is possible because HTTP lacks integrity checks, allowing an attacker to modify data in transit?

   • AUDP amplification
   • BSYN flood
   • CARP cache poisoning
   • DMan-in-the-middle (MITM) attack
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   A company is deploying a new web application that will be accessed by customers over the internet. The security team wants to protect against DNS spoofing and man-in-the-middle attacks on the application traffic. The application will use a custom domain name. The team has a limited budget and must choose the most effective combination of controls. Which combination provides the best protection?

   • ADeploy a web application firewall (WAF) and use DNS over HTTPS (DoH).
   • BUse a VPN for all customer traffic and implement DNSSEC.
   • CImplement DNSSEC for the domain and enforce HTTPS with HSTS on the web server.
   • DUse a public DNS resolver and implement HTTP Strict Transport Security (HSTS).
   Reveal Solution Discussion Select an answer first