Packet Sniffing Concepts EHE Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Which scenario best describes active sniffing?

   • AAn attacker monitors wireless traffic using a Wi-Fi adapter in monitor mode
   • BAn attacker sends forged ARP replies to associate their MAC address with the gateway's IP address
   • CAn attacker uses a network tap to copy traffic from a fiber optic cable
   • DAn attacker connects a laptop to a hub and captures all traffic passing through it
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A network administrator is explaining to a new analyst why passive sniffing is less common on modern networks. Which reason is most accurate?

   • AModern networks use IDS that detect passive sniffing
   • BModern networks use switches instead of hubs, so traffic is not broadcast to all ports
   • CModern networks use encryption by default, so passive sniffing is not useful
   • DModern networks use firewalls that block sniffing
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A network engineer is asked to capture traffic for a compliance audit. The network uses switches, and the engineer needs to capture traffic between two specific hosts without affecting other users. Which technique is appropriate?

   • AConfigure a SPAN port on the switch to mirror the traffic from the two hosts' ports
   • BUse ARP poisoning to redirect the hosts' traffic to the capture device
   • CConnect a hub between the two hosts and the switch
   • DUse MAC flooding to force the switch to broadcast the traffic
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A network administrator discovers that the switch's MAC address table is full and the switch is behaving like a hub, broadcasting all traffic to all ports. The administrator suspects an attack. Which attack is most likely occurring, and what is the immediate countermeasure?

   • APort mirroring; disable the SPAN session.
   • BARP poisoning; enable dynamic ARP inspection.
   • CMAC flooding; configure port security to limit the number of MAC addresses per port.
   • DDHCP starvation; enable DHCP snooping.
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A company is deploying a new application that transmits sensitive data over the network. The security team must ensure that the data is protected from passive sniffing while also allowing network monitoring for troubleshooting. The application currently uses a proprietary protocol that does not support encryption. Which approach best balances security and monitoring needs?

   • ADisable port mirroring to prevent unauthorized access to traffic.
   • BEncapsulate the application traffic in a VPN tunnel and use port mirroring to capture the encrypted traffic for monitoring.
   • CUse ARP poisoning to redirect traffic to a monitoring server.
   • DUse a network TAP to capture traffic and store it for analysis.
   Reveal Solution Discussion Select an answer first