Packet Sniffing Concepts EHE Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A security analyst suspects that an attacker on the same subnet is intercepting traffic between two servers. The analyst wants to confirm the attack without alerting the attacker. Which observation would most strongly indicate active sniffing?

   • AThe servers' ARP cache contains an entry mapping the gateway IP to an unknown MAC address
   • BThe switch's CAM table shows an unusually high number of MAC addresses on a single port
   • CThe network monitoring system shows a high volume of broadcast traffic
   • DThe servers' network interfaces are running in promiscuous mode
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   Which of the following is a network monitoring countermeasure that can help detect active sniffing attacks?

   • AConfiguring switches to use port mirroring
   • BDisabling ICMP echo requests on all hosts
   • CUsing static IP addresses on all devices
   • DUsing an intrusion detection system (IDS) to monitor for ARP anomalies
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A security analyst is monitoring a network segment that uses a hub. The analyst wants to capture traffic without being detected by the network's intrusion detection system (IDS). Which approach is most appropriate?

   • AConfigure port mirroring on the hub.
   • BFlood the switch with MAC addresses to force it to act like a hub.
   • CConnect a laptop to the hub and enable promiscuous mode on the network interface.
   • DSend ARP spoofing packets to redirect traffic to the laptop.
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   What is port mirroring used for in network monitoring?

   • ATo block all traffic on a specific port to prevent attacks
   • BTo change the MAC address of a switch port to hide its identity
   • CTo encrypt traffic on a specific port for secure transmission
   • DTo duplicate traffic from one or more switch ports to a monitoring port
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A network administrator is explaining to a junior technician why packet sniffing can be a security risk. The administrator wants to illustrate how an attacker can capture sensitive information. Which example best demonstrates the risk of packet sniffing?

   • AAn attacker sends a phishing email to trick a user into revealing their password.
   • BAn attacker exploits a buffer overflow to gain remote access to a server.
   • CAn attacker captures unencrypted HTTP traffic and reads a user's login credentials.
   • DAn attacker uses a port scanner to identify open ports on a server.
   Reveal Solution Discussion Select an answer first