Network-Level Attacks (sniffing, DoS/DDoS, Session Hijacking) ECSS Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   What is 'blind hijacking' in the context of TCP/IP session hijacking?

   • AAn attack where the attacker cannot see the victim's traffic and must guess sequence numbers
   • BAn attack that targets the application layer only
   • CAn attack that only works on wireless networks
   • DAn attack that uses ARP spoofing to intercept traffic
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A penetration tester is on a switched network and wants to sniff traffic between a target host and the default gateway. The tester wants to avoid detection and minimize disruption. Which technique should the tester use?

   • AMAC flooding the switch to force all traffic to be broadcast.
   • BEnable promiscuous mode and passively capture all traffic on the wire.
   • CUse a DHCP starvation attack to exhaust the IP pool and force the target to use the tester's IP.
   • DARP spoofing the target and gateway, then enable IP forwarding on the tester's machine.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   What is the role of a botnet in a DDoS attack?

   • ATo amplify the attack by using a small number of high-bandwidth servers
   • BTo encrypt the attacker's traffic to avoid detection
   • CTo provide a single source of attack traffic
   • DTo generate a large volume of traffic from many compromised devices simultaneously
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A security team is analyzing a DDoS attack against their web application. The attack traffic consists of large UDP packets sent to random ports on the server, and the source IPs are spoofed. The team wants to mitigate the attack while minimizing impact on legitimate users. Which mitigation is most effective?

   • AIncreasing server bandwidth and CPU capacity
   • BUsing a CDN or DDoS protection service that filters traffic based on packet signatures and behavior
   • CBlocking all UDP traffic at the firewall
   • DRate limiting all UDP traffic to the server
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A network administrator is troubleshooting a performance issue on a switched network. The administrator suspects that an attacker is using a sniffing tool to capture traffic. The administrator notices that the switch's CAM table is full and the switch is flooding unicast frames to all ports. Which sniffing technique is likely being used?

   • ADNS spoofing
   • BPassive sniffing with promiscuous mode
   • CMAC flooding
   • DARP spoofing
   Reveal Solution Discussion Select an answer first