Packet Sniffing Concepts EHE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A security analyst is comparing passive and active sniffing techniques for a security assessment. The analyst wants to use a technique that does not inject packets into the network. Which technique should the analyst choose?

   • AFlood the switch with MAC addresses.
   • BUse a tool like Cain & Abel to perform ARP poisoning.
   • CConnect to a port mirroring port on the switch.
   • DPerform ARP poisoning to redirect traffic.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A network administrator is troubleshooting a slow application and suspects packet loss. The administrator wants to capture traffic on a specific switch port without disrupting the network. The switch supports port mirroring. Which configuration should the administrator apply?

   • AUse ARP poisoning to redirect the server's traffic to the monitoring port.
   • BEnable promiscuous mode on the monitoring port.
   • CConnect a hub between the server and the switch.
   • DConfigure a SPAN session to mirror the application server's port to a monitoring port.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A network administrator needs to capture packets on a Linux server's command line interface to troubleshoot a connectivity issue. The administrator wants to save the capture to a file for later analysis. Which tool and command should the administrator use?

   • Anetstat -i eth0 -w capture.pcap
   • BWireshark -i eth0 -w capture.pcap
   • Ctcpdump -i eth0 -w capture.pcap
   • Dnmap -i eth0 -w capture.pcap
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A company handles sensitive customer data and wants to minimize the risk of packet sniffing on its internal network. The network carries both legacy HTTP-based applications and modern HTTPS-based services. Which countermeasure is most effective across the entire network?

   • ADisable promiscuous mode on all network interfaces
   • BDeploy a network intrusion detection system to monitor for sniffing tools
   • CImplement encryption for all sensitive traffic, including migrating HTTP applications to HTTPS
   • DUse port security on switches to prevent MAC flooding attacks
   Reveal Solution Discussion Select an answer first
6. 10expert · hard · select all that apply

   A security analyst is investigating a suspected ARP poisoning attack. Which of the following are valid indicators of ARP poisoning? (Select all that apply.)

   • AThe network interface card is in promiscuous mode.
   • BMultiple IP addresses mapping to the same MAC address in the ARP cache.
   • CThe switch's MAC address table is full.
   • DThe victim's default gateway MAC address changes unexpectedly.
   • EA sudden increase in ARP reply traffic on the network.
   Check answers Discussion Select an answer first