Network-Level Attacks (sniffing, DoS/DDoS, Session Hijacking) ECSS Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A penetration tester is attempting to hijack a TCP session between a client and a server. The tester can observe the network traffic and wants to inject malicious data into the session. The tester has successfully predicted the next sequence number. Which action should the tester take to complete the hijack?

   • ASend a crafted packet to the server with the predicted sequence number and a spoofed source IP address.
   • BSend a SYN packet to the server to establish a new session.
   • CSend a RST packet to the server to terminate the session.
   • DSend a forged DNS response to redirect the server's traffic.
   Reveal Solution Discussion Select an answer first
2. 37expert · medium

   A network administrator is troubleshooting intermittent connectivity issues on a switch. The switch logs show that the CAM table is frequently full, and the switch is broadcasting frames to all ports. Which attack is likely occurring?

   • AARP spoofing
   • BSYN flood
   • CMAC flooding
   • DDNS cache poisoning
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   What is a session token used for in web applications?

   • ATo uniquely identify a user's session and maintain authentication state
   • BTo verify the integrity of the network connection
   • CTo store the user's IP address for security
   • DTo encrypt the user's password
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A penetration tester is hired to assess a company's internal network. The tester connects a laptop to a switch port and needs to capture traffic between two other hosts on the same VLAN. The switch does not support port mirroring. Which technique should the tester use to redirect the target's traffic through the tester's machine so it can be captured?

   • ASend ARP replies to the target and the gateway, associating the tester's MAC address with the gateway's IP address.
   • BSend a continuous stream of fake MAC addresses to fill the switch's CAM table.
   • CEnable promiscuous mode on the network interface and passively capture all frames on the wire.
   • DUse a DHCP starvation attack to exhaust the IP address pool and force the target to use the tester's IP address.
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   What is the primary difference between active and passive session hijacking?

   • AActive hijacking requires physical access, while passive hijacking requires remote access
   • BActive hijacking is used for HTTPS, while passive hijacking is used for HTTP
   • CActive hijacking modifies the session traffic, while passive hijacking only observes it
   • DActive hijacking involves intercepting traffic, while passive hijacking involves modifying traffic
   Reveal Solution Discussion Select an answer first