Traffic Interception and Manipulation GXPN Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   In a man-in-the-middle (MITM) attack, the attacker positions themselves between two communicating parties. What is the primary goal of this positioning?

   • ATo gain physical access to the network
   • BTo block all traffic between the parties
   • CTo intercept and potentially alter communications
   • DTo impersonate the server to the client only
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A penetration tester is performing a MITM attack and has successfully intercepted a TLS-encrypted session. The tester has the private key of the certificate presented to the client. Which manipulation technique can the tester now perform?

   • AInject packets directly into the encrypted stream without decryption.
   • BPerform a TLS renegotiation attack to downgrade the cipher suite.
   • CDecrypt the TLS traffic, modify the plaintext application data, and re-encrypt it with the same session keys.
   • DUse the private key to impersonate the server to other clients.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A network administrator is implementing countermeasures against traffic interception and manipulation. The administrator wants to detect ARP spoofing and rogue DHCP servers on the network. Which combination of switch features should the administrator enable?

   • ASpanning Tree Protocol (STP) and Link Aggregation.
   • BPort Security and MAC Address Filtering.
   • CVLAN Segmentation and Private VLANs.
   • DDynamic ARP Inspection (DAI) and DHCP Snooping.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A penetration tester is on a switched network and needs to intercept traffic between two specific hosts to perform a MITM attack. The tester has physical access to the network and can connect a laptop to an unused switch port. The switch does not support port mirroring. Which approach should the tester use to become the man-in-the-middle?

   • ADeploy a rogue DHCP server to assign the tester's IP as the default gateway for the entire subnet.
   • BConfigure the laptop's NIC in promiscuous mode and connect it to the same VLAN as the target hosts.
   • CPerform ARP spoofing against both hosts, sending them the tester's MAC address as the destination for their traffic.
   • DUse MAC flooding to overflow the switch's CAM table, causing it to broadcast all frames to all ports.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A penetration tester is assessing a small office network that uses a single unmanaged switch. The tester needs to capture and modify HTTP traffic between a specific workstation and the default gateway, but the tester does not have credentials to the switch. Which technique should the tester use to place themselves in the traffic path?

   • AEnable port mirroring on the switch by sending a specially crafted Cisco Discovery Protocol (CDP) packet.
   • BDeploy a rogue DHCP server that assigns the tester's IP as the default gateway to all clients.
   • CUse ARP spoofing to associate the tester's MAC address with the gateway's IP address in the workstation's ARP cache.
   • DSend a continuous stream of bogus MAC addresses to the switch to overflow its CAM table, causing it to flood frames out all ports.
   Reveal Solution Discussion Select an answer first