Which protocol vulnerability is exploited when an attacker intercepts an HTTPS session by presenting a forged certificate that the client accepts due to improper validation?

TLS certificate validation bypass

A security analyst is investigating a possible MITM attack and notices that the network's DNS server is receiving queries from an unusual source. The analyst suspects DNS spoofing. Which countermeasure would be most effective in preventing DNS spoofing?

Use a firewall to block all DNS traffic except from the internal DNS server.

Implement DNSSEC to authenticate DNS responses.

Use a local DNS cache on each workstation.

Which of the following is a common sign that ARP spoofing may be occurring on a network?

Multiple IP addresses mapping to the same MAC address in the ARP cache

A single MAC address mapping to only one IP address

A penetration tester is using ettercap to perform a MITM attack on a local network. The tester wants to intercept and modify traffic between a client and a server. Which ettercap feature should the tester use to achieve this?

The 'sniffing' mode to passively capture traffic.

The 'port mirroring' feature to capture traffic from the switch.

The 'DNS spoofing' plugin to redirect the client to a fake server.

The 'ARP poisoning' plugin combined with the 'filter' feature.

GIAC Exploit Researcher and Advanced Penetration Tester

Domain 3Objective 3

Traffic Interception and Manipulation GXPN Practice Questions (Page 1)

Part of the Network and Infrastructure Attacks domain, which makes up ~14% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~10–17 in this domain), expect 3–6 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

6concepts

Questions 1–5

1foundation · easy
Which protocol vulnerability is exploited when an attacker intercepts an HTTPS session by presenting a forged certificate that the client accepts due to improper validation?
Select an answer first
2expert · hard
A security analyst is investigating a possible MITM attack and notices that the network's DNS server is receiving queries from an unusual source. The analyst suspects DNS spoofing. Which countermeasure would be most effective in preventing DNS spoofing?
Select an answer first
3foundation · easy
Which of the following is a common sign that ARP spoofing may be occurring on a network?
Select an answer first
4application · medium
A penetration tester is using ettercap to perform a MITM attack on a local network. The tester wants to intercept and modify traffic between a client and a server. Which ettercap feature should the tester use to achieve this?
Select an answer first
5foundation · easy
An attacker intercepts a TCP connection and alters the sequence numbers and payload of packets in transit to change the content of a file being downloaded. Which traffic manipulation technique is being used?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GXPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GXPN” is a trademark of its owner, used for identification only.