Network-Level Attacks (sniffing, DoS/DDoS, Session Hijacking) ECSS Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A security analyst is investigating a possible session hijacking incident. The analyst notices that an attacker was able to predict the TCP sequence numbers of an active session and inject malicious data into the stream. The analyst also notices that the attacker was able to observe the network traffic. Which type of session hijacking occurred, and what is the most effective countermeasure?

   • AApplication-level session hijacking; use session timeout.
   • BBlind TCP session hijacking; use random sequence numbers.
   • CActive TCP session hijacking; use encryption (TLS) to protect the session.
   • DPassive TCP session hijacking; use IPsec to authenticate packets.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which mitigation technique is specifically designed to limit the number of requests a server accepts from a single source over a given time period?

   • ARate limiting
   • BSession timeout
   • CMAC filtering
   • DPort security
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A network administrator wants to detect ARP spoofing attacks on the corporate network. Which monitoring approach is most effective?

   • ADisable dynamic ARP learning on all switches
   • BMonitor the switch's CAM table for multiple MAC addresses on a single port
   • CUse an intrusion detection system (IDS) that tracks ARP replies and detects IP-to-MAC address changes
   • DEnable port security to limit the number of MAC addresses per port
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security analyst needs to capture traffic between a specific workstation and the default gateway on a switched network segment. The analyst has administrative credentials on the workstation and can install software on it. Which approach will reliably capture the target traffic with the least disruption to other users?

   • APerform ARP spoofing against the workstation and the gateway, then run a sniffer on the analyst's machine.
   • BEnable promiscuous mode on the workstation's NIC and run a packet sniffer locally.
   • CInstall a packet capture agent on the workstation and capture traffic locally on that host.
   • DUse MAC flooding on the switch to force the port into hub mode, then sniff from any port.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company's firewall logs show a large number of TCP SYN packets to a web server from a single IP address, but the server never completes the handshake. The server's connection table is full, and legitimate users cannot connect. Which type of attack is this?

   • APing of death
   • BSYN flood
   • CUDP flood
   • DDNS amplification
   Reveal Solution Discussion Select an answer first