Network-Level Attacks (sniffing, DoS/DDoS, Session Hijacking) ECSS Practice Questions (Page 10)

Questions 46–50

1. 46foundation · easy

   What is the key challenge an attacker must overcome in TCP/IP session hijacking?

   • ABypassing the firewall
   • BPredicting or obtaining the correct TCP sequence numbers
   • CObtaining the victim's password
   • DDecrypting the TLS traffic
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   A company's e-commerce site is suffering from an application-layer DDoS attack that sends many legitimate-looking HTTP requests to a search endpoint, causing high CPU usage. The requests come from many different IP addresses. Which mitigation is most effective for this specific attack?

   • ABlocking all traffic from non-residential IP ranges
   • BWeb application firewall (WAF) with behavioral analysis and CAPTCHA challenges
   • CRate limiting based on source IP
   • DIncreasing the server's CPU capacity
   Reveal Solution Discussion Select an answer first
4. 48foundation · easy

   How does a Content Delivery Network (CDN) help mitigate DDoS attacks?

   • ABy distributing traffic across multiple servers and absorbing attack traffic
   • BBy blocking all traffic from unknown IP addresses
   • CBy increasing the server's processing power
   • DBy encrypting all traffic between the client and server
   Reveal Solution Discussion Select an answer first
5. 49expert · hard

   A penetration tester is attempting to hijack a TCP session between a client and a server. The tester can sniff the network and observe the current sequence numbers but cannot intercept or modify packets in transit. The tester wants to inject a malicious packet into the session. Which technique is most appropriate?

   • AActive hijacking by sending a forged packet with the observed sequence number
   • BSession fixation to set the client's sequence number
   • CPassive sniffing to steal the session token
   • DBlind hijacking with sequence number prediction
   Reveal Solution Discussion Select an answer first
6. 50foundation · easy

   What is the primary purpose of placing a network interface card (NIC) into promiscuous mode when performing network sniffing?

   • ATo enable the NIC to process frames addressed to its own MAC address only
   • BTo increase the transmission speed of the NIC by bypassing error checking
   • CTo allow the NIC to capture and process all frames it receives, regardless of destination MAC address
   • DTo encrypt all outgoing frames to prevent interception
   Reveal Solution Discussion Select an answer first