Packet Sniffing Concepts EHE Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which tool is a command-line packet analyzer commonly available on Unix-like systems?

   • AWireshark
   • BNmap
   • Ctcpdump
   • DCain & Abel
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which characteristic distinguishes passive sniffing from active sniffing?

   • APassive sniffing injects packets into the network to elicit responses
   • BPassive sniffing requires the attacker to be on the same subnet as the target
   • CPassive sniffing does not alter network traffic, while active sniffing may inject or redirect traffic
   • DPassive sniffing only works on switched networks
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A security administrator is implementing countermeasures against packet sniffing on a network that carries both legacy plaintext protocols and modern encrypted protocols. The administrator wants to minimize the risk of credential theft while maintaining compatibility with legacy devices. Which approach is most effective?

   • ASegment the network so that legacy plaintext devices are isolated from the rest of the network and use encrypted protocols for all new traffic.
   • BImplement port security on all switch ports.
   • CDisable all legacy plaintext protocols immediately.
   • DUse ARP poisoning to redirect legacy traffic to a security appliance.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A network administrator is trying to decide between passive and active sniffing techniques to troubleshoot a network issue. The administrator has access to the switch and can configure it, but the network is highly sensitive to downtime. Which approach should the administrator choose to minimize disruption?

   • AUse MAC flooding to force the switch to broadcast traffic.
   • BUse a hub to replace the switch temporarily.
   • CUse ARP poisoning to redirect traffic to a monitoring host.
   • DConfigure port mirroring to capture traffic passively.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security analyst is investigating a suspected ARP poisoning attack on a corporate network. The analyst wants to confirm the attack and identify the attacker's MAC address. Which action should the analyst take?

   • ACapture traffic on the switch's uplink port to see all broadcast traffic.
   • BDisable the switch's STP to prevent MAC address changes.
   • CInspect the ARP cache on the affected hosts and look for duplicate IP-to-MAC mappings.
   • DRun a port scan on the affected hosts to identify open ports.
   Reveal Solution Discussion Select an answer first