1.7 Detect and Mitigate Common Types of Attacks CCIE-SECURITY Practice Questions (Page 11)

Questions 51–55

1. 51expert · hard

   A company is implementing anti-spoofing measures on their network. They have a router that connects to the internet and a switch that connects to internal hosts. The internal hosts use DHCP. The company wants to prevent IP spoofing from internal hosts and also prevent ARP spoofing. Which set of configurations would achieve both goals?

   • AEnable DHCP snooping on the switch and uRPF on the router's external interface
   • BEnable port security on the switch and egress filtering on the router
   • CConfigure static ARP entries on all hosts and use a firewall
   • DEnable uRPF on the router's internal interface and DAI on the switch
   Reveal Solution Discussion Select an answer first
2. 52application · medium

   A security analyst notices that the intrusion prevention system (IPS) is not alerting on a known exploit signature, even though the exploit is being attempted. Upon reviewing packet captures, the analyst sees that the malicious payload is split across multiple TCP segments, with each segment smaller than the signature's pattern size. Which technique is being used to evade the IPS, and what is the BEST countermeasure?

   • ATCP segmentation; enable stream reassembly and normalization on the IPS
   • BProtocol obfuscation; disable deep packet inspection
   • CPayload encoding; use a stateful firewall instead of an IPS
   • DIP fragmentation; enable IP fragment reassembly on the IPS
   Reveal Solution Discussion Select an answer first
4. 53expert · hard

   A company is experiencing a DDoS attack that is a combination of a SYN flood and an HTTP flood. The SYN flood is consuming network resources, and the HTTP flood is overwhelming the web server. The company has a firewall and an IPS. Which mitigation strategy would be MOST effective in addressing both attack vectors?

   • AIncrease the firewall's connection table size and add more web servers
   • BEnable SYN cookies on the firewall and configure the IPS to rate-limit HTTP requests
   • CBlackhole the web server's IP address
   • DUse a DDoS mitigation service that provides both L3/L4 and L7 protection
   Reveal Solution Discussion Select an answer first
5. 54application · medium

   A security engineer is investigating a report that users on the corporate network are seeing browser warnings about invalid certificates when visiting an internal website. The engineer suspects an SSL stripping attack. Which additional observation would CONFIRM the attack, and what is the BEST prevention measure?

   • AUsers are experiencing slow connections; implement QoS
   • BUsers are receiving ARP replies from an unknown MAC; enable dynamic ARP inspection (DAI)
   • CUsers are being redirected to an HTTP version of the site; enforce HTTPS with HSTS
   • DUsers' DNS queries are being answered by an unauthorized server; configure DNSSEC
   Reveal Solution Discussion Select an answer first
6. 55application · medium

   A security operations center (SOC) is monitoring network traffic and notices a large number of internal hosts making periodic outbound connections to the same external IP address on port 443, but the traffic patterns are not typical of web browsing. The SOC suspects a botnet. Which action would BEST confirm the botnet and potentially disrupt its command-and-control (C2) channel?

   • ABlock the external IP address at the firewall
   • BPerform a deep packet inspection (DPI) on the traffic to identify C2 signatures
   • CDisable the internal hosts' internet access
   • DRun an antivirus scan on the internal hosts
   Reveal Solution Discussion Select an answer first