A network administrator is investigating a possible ARP spoofing attack. Which observation would be the strongest indicator of ARP spoofing?

The workstation's ARP cache contains multiple entries for the same IP address.

The workstation's ARP cache contains an entry for the gateway with a MAC address that is not in the switch's MAC address table.

The network is experiencing a high volume of broadcast traffic.

The ARP cache of a workstation shows a different MAC address for the gateway than the one recorded in the switch's MAC address table.

A penetration tester is assessing a network where the client uses HSTS for a critical web application. The tester has performed ARP spoofing and wants to intercept the HTTPS traffic. The tester does not have a valid certificate for the domain. Which technique should the tester use to successfully intercept the traffic?

Use a self-signed certificate and hope the user accepts the warning.

Perform SSL/TLS stripping by modifying the HTTP response to remove the HSTS header.

Use a DNS spoofing attack to redirect the client to a fake server with a valid certificate for a similar domain.

Perform a certificate pinning bypass by injecting a malicious script.

A penetration tester is on a network with a switch that has port security enabled, limiting each port to one MAC address. The tester wants to perform a MITM attack between two hosts. Which technique should the tester use to bypass the port security and achieve the MITM position?

Use ARP spoofing, which does not require adding multiple MAC addresses to the switch port.

Use MAC flooding to overwhelm the switch and disable port security.

Use a rogue DHCP server to assign the tester's MAC as the gateway.

Use a VLAN hopping attack to access the target's VLAN.

GIAC Exploit Researcher and Advanced Penetration Tester

Domain 3Objective 3

Traffic Interception and Manipulation GXPN Practice Questions (Page 6)

Part of the Network and Infrastructure Attacks domain, which makes up ~14% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~10–17 in this domain), expect 3–6 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

6concepts

Questions 26–30

26application · medium
A network administrator is investigating a possible ARP spoofing attack. Which observation would be the strongest indicator of ARP spoofing?
Select an answer first
27expert · hard
A penetration tester is assessing a network where the client uses HSTS for a critical web application. The tester has performed ARP spoofing and wants to intercept the HTTPS traffic. The tester does not have a valid certificate for the domain. Which technique should the tester use to successfully intercept the traffic?
Select an answer first
28expert · hard
A penetration tester is on a network with a switch that has port security enabled, limiting each port to one MAC address. The tester wants to perform a MITM attack between two hosts. Which technique should the tester use to bypass the port security and achieve the MITM position?
Select an answer first
29foundation · easy
After successfully intercepting a TCP session between a client and a server, an attacker injects crafted packets into the stream to alter the data being transmitted. Which traffic manipulation technique is being used?
Select an answer first
30application · easy
A penetration tester is using Wireshark to capture traffic on a network and wants to identify ARP spoofing activity. Which Wireshark display filter should the tester use to see ARP packets that might indicate spoofing?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GXPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GXPN” is a trademark of its owner, used for identification only.

Traffic Interception and Manipulation GXPN Practice Questions (Page 6)

Questions 26–30

A network administrator is investigating a possible ARP spoofing attack. Which observation would be the strongest indicator of ARP spoofing?

A penetration tester is on a network with a switch that has port security enabled, limiting each port to one MAC address. The tester wants to perform a MITM attack between two hosts. Which technique should the tester use to bypass the port security and achieve the MITM position?

After successfully intercepting a TCP session between a client and a server, an attacker injects crafted packets into the stream to alter the data being transmitted. Which traffic manipulation technique is being used?

A penetration tester is using Wireshark to capture traffic on a network and wants to identify ARP spoofing activity. Which Wireshark display filter should the tester use to see ARP packets that might indicate spoofing?

Keep studying — Network and Infrastructure Attacks