Network-Level Attacks (sniffing, DoS/DDoS, Session Hijacking) ECSS Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   A penetration tester is performing a DNS spoofing attack on a local network. The tester wants to redirect a victim's traffic to a malicious server for a specific domain, but the victim uses a DNS server that is not vulnerable to cache poisoning. Which technique could the tester use?

   • AARP spoofing to intercept the victim's DNS queries and respond with a fake DNS reply
   • BTCP sequence number prediction to inject DNS responses
   • CSession hijacking to modify the victim's DNS settings
   • DMAC flooding to force the switch into hub mode and then sniff the DNS responses
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A security analyst is reviewing web application logs and notices that a user's session ID was sent in the URL query string. The analyst is concerned that an attacker could capture this session ID from proxy logs or browser history. Which countermeasure would best prevent session hijacking in this scenario?

   • AUse HTTP-only and Secure flags on the session cookie.
   • BUse IP-based session binding to ensure the session is only valid from the same IP address.
   • CImplement a short session timeout to limit the window of opportunity.
   • DStore the session ID in a cookie with the Secure flag and use HTTPS.
   Reveal Solution Discussion Select an answer first
4. 43expert · medium

   A web application developer wants to protect against session hijacking. The application uses cookies for session management. The developer is considering implementing HTTP-only cookies, Secure cookies, and a short session timeout. Which combination of these measures is most effective?

   • ASecure cookies only.
   • BHTTP-only cookies only.
   • CShort session timeout only.
   • DHTTP-only and Secure cookies, plus a short session timeout.
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A security analyst is investigating a session hijacking incident. The attacker was able to take over an authenticated session on a web application. The application uses HTTPS and sets the Secure and HttpOnly flags on session cookies. The analyst suspects the attack occurred via a man-in-the-middle (MITM) attack. Which additional countermeasure would be most effective?

   • AImplement a session timeout
   • BUse a longer session token
   • CImplement certificate pinning or use HTTP Strict Transport Security (HSTS)
   • DRegenerate the session ID after login
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   A company is experiencing a DDoS attack that is saturating their internet link. The attack consists of large ICMP echo requests from many spoofed IP addresses. The company wants to mitigate the attack without affecting legitimate ICMP traffic (e.g., ping for troubleshooting). Which mitigation is most appropriate?

   • AUse a CDN to absorb the ICMP flood
   • BBlock all ICMP traffic at the firewall
   • CRate limit ICMP traffic to a reasonable threshold
   • DIncrease the internet link bandwidth
   Reveal Solution Discussion Select an answer first