Defending Network Protocols GCED Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A security analyst is analyzing a packet capture from a network that uses both IPv4 and IPv6. The analyst sees a host sending ICMPv6 Router Advertisement messages claiming to be the default gateway. The host is not the legitimate router. What is the most likely attack, and which mitigation would be most effective?

   • AIPv6 neighbor discovery poisoning; enable DHCPv6 snooping
   • BIPv6 extension header attack; filter extension headers
   • CIPv6 router advertisement spoofing; enable RA Guard on switches
   • DIPv6 fragmentation attack; disable fragmentation
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A company wants to secure its web application against man-in-the-middle attacks. Which configuration should be implemented on the web server?

   • AUse a self-signed certificate
   • BAllow both HTTP and HTTPS
   • CDisable TLS and use only HTTP
   • DEnforce HTTPS with HSTS (HTTP Strict Transport Security)
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A security analyst is investigating a suspected ARP poisoning attack. The analyst has access to a packet capture and the switch's MAC address table. Which combination of findings would most strongly confirm ARP poisoning?

   • AMultiple ARP replies for the same IP address with different MAC addresses, and the switch MAC table shows the same MAC address on multiple ports
   • BA high volume of TCP SYN packets to a single host
   • CDNS responses from an unexpected IP address
   • DICMP echo requests to a broadcast address
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A network administrator notices that a server is receiving an unusually high volume of ICMP echo requests from many different source IP addresses. The server's CPU usage is high, and the network link is saturated. Which type of attack is most likely occurring?

   • AICMP flood
   • BICMP redirect attack
   • CPing of death
   • DSmurf attack
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A network administrator is tasked with securing the network against DNS cache poisoning. The administrator has a mix of legacy and modern DNS servers. Which approach provides the most effective protection while maintaining compatibility?

   • ADisable recursion on all DNS servers
   • BUse DNS over HTTPS (DoH) for all client queries
   • CIncrease the TTL on all DNS records
   • DImplement DNSSEC on all DNS servers and validate responses
   Reveal Solution Discussion Select an answer first