Common Network Protocols GNFA Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   A network analyst is investigating a DHCP starvation attack on a corporate network. The analyst observes a large number of DHCPDISCOVER messages from different MAC addresses, but all requests are for the same hostname. The DHCP server has exhausted its address pool, and legitimate clients are unable to obtain IP addresses. Which mitigation would be most effective in preventing this specific attack while minimizing operational impact?

   • AConfigure DHCP snooping on the switches to limit the rate of DHCP requests per port and validate DHCP messages.
   • BConfigure the DHCP server to ignore requests from MAC addresses that are not in the allowed list.
   • CDisable the DHCP server and assign static IP addresses to all clients.
   • DIncrease the DHCP lease time to reduce the frequency of renewals and conserve address pool usage.
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   In IPv6, which protocol replaces ARP for resolving IP addresses to link-layer addresses?

   • AICMPv6 Neighbor Discovery (ND)
   • BRARP
   • CDNS
   • DDHCPv6
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   A forensic analyst is examining email headers from a suspicious email received by an employee. The headers show that the email was sent from an internal mail server (SMTP) and received via POP3. The analyst wants to determine the original sender's IP address. Which header field should the analyst examine?

   • AThe 'Message-ID' header, which contains the IP address of the originating client.
   • BThe 'From' header, which contains the sender's email address and IP address.
   • CThe 'Received' header, which contains the IP address of the sending mail server or client.
   • DThe 'Return-Path' header, which contains the IP address of the sender's mail server.
   Reveal Solution Discussion Select an answer first
5. 44application · easy

   A forensic analyst is examining an Ethernet frame captured on a local network. The frame has a destination MAC address of ff:ff:ff:ff:ff:ff and contains an ARP request. What is the purpose of this broadcast frame?

   • ATo discover the MAC address of a host that has a specific IP address on the local network.
   • BTo resolve a MAC address to an IP address for reverse address lookup.
   • CTo send a message to all hosts on the internet, asking for a route to a remote network.
   • DTo notify all hosts of a new switch's MAC address table.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A network administrator needs to transfer a firmware image to a network switch. The switch only supports TFTP for firmware updates. The administrator is concerned about the reliability of the transfer. What should the administrator do to ensure the firmware image is transferred correctly?

   • ASwitch to FTP, which uses TCP and provides reliable transfer with error checking.
   • BIncrease the TFTP timeout value to allow more time for the transfer to complete.
   • CUse TFTP with a checksum verification after the transfer to confirm the file integrity.
   • DUse TFTP over a VPN to add encryption and reliability.
   Reveal Solution Discussion Select an answer first