Packet Sniffing Concepts EHE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A network administrator needs to capture traffic on a switched network segment to troubleshoot a performance issue between two servers. The administrator has administrative access to the switch but cannot reconfigure the servers or install software on them. Which approach should the administrator use?

   • APerform ARP poisoning to redirect the servers' traffic through the administrator's workstation.
   • BFlood the switch with MAC addresses to force it into hub mode and capture all traffic.
   • CConnect a laptop to the same VLAN and enable promiscuous mode to capture all VLAN traffic.
   • DConfigure port mirroring on the switch to forward traffic from the servers' ports to a monitoring port.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which sniffing technique involves sending forged ARP messages to associate the attacker's MAC address with the IP address of a legitimate network device?

   • AARP poisoning
   • BDNS spoofing
   • CMAC flooding
   • DPort mirroring
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A network engineer needs to capture and analyze traffic on a network segment where the switch does not support port mirroring. The engineer has physical access to the network and can insert a device inline. Which tool and technique should the engineer use?

   • AUse tcpdump on the router's management interface.
   • BUse Wireshark in promiscuous mode on a laptop connected to the same switch.
   • CUse ARP poisoning to redirect traffic to the engineer's laptop.
   • DUse a network TAP (test access point) to passively copy traffic between two devices.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security analyst is monitoring a network and notices that the switch's CAM table is full, causing the switch to broadcast all traffic. Which attack is the analyst likely observing?

   • APort mirroring
   • BPassive sniffing
   • CMAC flooding
   • DARP poisoning
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security team wants to detect ARP poisoning attacks on their network. They plan to deploy a monitoring solution. Which approach is most effective for detecting ARP poisoning?

   • AMonitor for excessive broadcast traffic.
   • BMonitor for changes in MAC address tables.
   • CMonitor for high CPU usage on the switch.
   • DMonitor ARP traffic and alert on duplicate IP-to-MAC mappings.
   Reveal Solution Discussion Select an answer first