A penetration tester is performing an assessment and wants to intercept and modify traffic between a client and a server that uses TLS. The tester has already achieved a MITM position and has installed a custom root CA on the client. Which additional step is necessary to successfully decrypt and re-encrypt the TLS traffic?

Use a packet sniffer to capture the TLS keys from the client.

Use a downgrade attack to force the client to use SSLv3.

Generate a certificate for the target domain signed by the custom root CA and use it in the MITM proxy.

Disable TLS on the server to force the client to use HTTP.

During a red team exercise, a tester successfully performs ARP spoofing between a client and a web server. The client is using HTTPS, and the tester wants to inject a malicious script into the client's browser session. Which approach would allow the tester to manipulate the HTTPS traffic?

Use DNS spoofing to redirect the client to a lookalike domain that uses a valid certificate for that lookalike domain.

Present a self-signed certificate for the target domain and hope the client accepts the browser warning.

Strip the TLS encryption by sending a TCP RST to the client and then serving a plain HTTP version of the site.

Install a trusted root CA certificate on the client and generate a valid certificate for the target domain.

GIAC Exploit Researcher and Advanced Penetration Tester

Domain 3Objective 3

Traffic Interception and Manipulation GXPN Practice Questions (Page 4)

Part of the Network and Infrastructure Attacks domain, which makes up ~14% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~10–17 in this domain), expect 3–6 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

6concepts

Questions 16–20

16expert · hard
A penetration tester is performing an assessment and wants to intercept and modify traffic between a client and a server that uses TLS. The tester has already achieved a MITM position and has installed a custom root CA on the client. Which additional step is necessary to successfully decrypt and re-encrypt the TLS traffic?
Select an answer first
17foundation · easy
An attacker floods a network switch with thousands of frames containing random source MAC addresses. The switch's CAM table overflows, and the switch begins to flood unicast frames out of all ports. Which traffic interception technique does this describe?
Select an answer first
18application · medium
A penetration tester is on a network and wants to perform a MITM attack to capture credentials from a target that uses a legacy application with unencrypted protocols. The tester wants to use a tool that can automatically spoof ARP and sniff credentials. Which tool is best suited for this task?
Select an answer first
19application · medium
During a red team exercise, a tester successfully performs ARP spoofing between a client and a web server. The client is using HTTPS, and the tester wants to inject a malicious script into the client's browser session. Which approach would allow the tester to manipulate the HTTPS traffic?
Select an answer first
20foundation · easy
An attacker intercepts a user's HTTP session and steals the session cookie. The attacker then uses that cookie to impersonate the user and make requests on their behalf. Which traffic manipulation technique is being used?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GXPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GXPN” is a trademark of its owner, used for identification only.

Traffic Interception and Manipulation GXPN Practice Questions (Page 4)

Questions 16–20

An attacker floods a network switch with thousands of frames containing random source MAC addresses. The switch's CAM table overflows, and the switch begins to flood unicast frames out of all ports. Which traffic interception technique does this describe?

A penetration tester is on a network and wants to perform a MITM attack to capture credentials from a target that uses a legacy application with unencrypted protocols. The tester wants to use a tool that can automatically spoof ARP and sniff credentials. Which tool is best suited for this task?

During a red team exercise, a tester successfully performs ARP spoofing between a client and a web server. The client is using HTTPS, and the tester wants to inject a malicious script into the client's browser session. Which approach would allow the tester to manipulate the HTTPS traffic?

An attacker intercepts a user's HTTP session and steals the session cookie. The attacker then uses that cookie to impersonate the user and make requests on their behalf. Which traffic manipulation technique is being used?

Keep studying — Network and Infrastructure Attacks