Network-Level Attacks (sniffing, DoS/DDoS, Session Hijacking) ECSS Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which of the following tools is commonly used to perform ARP spoofing attacks?

   • ASqlmap
   • BEttercap
   • CHydra
   • DNikto
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is the primary purpose of MAC flooding in the context of network attacks?

   • ATo redirect traffic to the attacker's machine for sniffing
   • BTo cause a denial of service by exhausting the switch's memory
   • CTo inject malicious DNS records into the resolver
   • DTo poison the ARP cache of the target host
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is the purpose of command-and-control (C&C) infrastructure in a DDoS attack?

   • ATo coordinate the actions of the botnet's compromised devices
   • BTo hide the attacker's identity by routing traffic through proxies
   • CTo amplify the attack traffic by using DNS reflection
   • DTo filter out legitimate traffic before it reaches the target
   Reveal Solution Discussion Select an answer first
5. 24application · easy

   A security analyst is investigating a DDoS attack against a company's web server. The attack traffic originates from thousands of compromised IoT devices that are sending HTTP requests to the server. The analyst notices that the devices are receiving commands from a central server. Which component of the DDoS architecture is the central server?

   • AThe amplification vector
   • BThe botnet
   • CThe target
   • DThe command-and-control (C&C) server
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A penetration tester is performing an internal assessment. The tester wants to redirect a victim's web traffic to a fake login page by manipulating the resolution of a domain name. The tester has control of a rogue DNS server on the same network. Which technique should the tester use to poison the victim's DNS cache?

   • ASend a forged DNS response to the victim's DNS resolver before the legitimate response arrives.
   • BPerform a TCP session hijack on the victim's DNS query connection.
   • CUse a MAC flooding attack to force the switch to broadcast DNS queries to all ports.
   • DSend ARP replies to associate the victim's IP address with the tester's MAC address.
   Reveal Solution Discussion Select an answer first