Which countermeasure is effective in preventing ARP spoofing attacks on a network?

Using a hub instead of a switch

Enabling Dynamic ARP Inspection (DAI) on switches

Setting static ARP entries on all devices

A penetration tester is conducting an assessment and wants to perform a MITM attack between a client and a server on a switched network. The tester has a laptop with two network interfaces. Which setup would allow the tester to intercept and forward traffic?

Configure the laptop as a transparent bridge and connect it between the client and the switch.

Use a rogue DHCP server to assign the laptop's IP as the default gateway for both hosts.

Enable IP forwarding on the tester's laptop and use ARP spoofing to redirect traffic from both the client and the server to the laptop.

Connect the laptop to a hub and use a packet sniffer to capture all traffic.

A penetration tester is on a network segment and wants to intercept traffic from a target host. The tester notices that the switch is configured with port security that limits the number of MAC addresses per port. Which interception technique would be least affected by this port security configuration?

Rogue DHCP, because it assigns IP addresses to clients.

Port mirroring, because it requires switch configuration.

ARP spoofing, because it only requires sending ARP replies and does not flood the switch.

MAC flooding, because it overwhelms the switch with many MAC addresses.

GIAC Exploit Researcher and Advanced Penetration Tester

Domain 3Objective 3

Traffic Interception and Manipulation GXPN Practice Questions (Page 7)

Part of the Network and Infrastructure Attacks domain, which makes up ~14% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~10–17 in this domain), expect 3–6 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

6concepts

Questions 31–35

31foundation · easy
Which countermeasure is effective in preventing ARP spoofing attacks on a network?
Select an answer first
32application · medium
A security analyst is investigating a report of slow network performance and sees an unusually high number of ARP replies on the network. The analyst suspects a MITM attack. Which tool would allow the analyst to confirm the attack by actively sending spoofed ARP packets to the target and gateway, and also provide a plugin to sniff credentials?
Select an answer first
33application · medium
A penetration tester is conducting an assessment and wants to perform a MITM attack between a client and a server on a switched network. The tester has a laptop with two network interfaces. Which setup would allow the tester to intercept and forward traffic?
Select an answer first
34application · medium
A penetration tester is on a network segment and wants to intercept traffic from a target host. The tester notices that the switch is configured with port security that limits the number of MAC addresses per port. Which interception technique would be least affected by this port security configuration?
Select an answer first
35foundation · easy
An attacker deploys an unauthorized DHCP server on a network segment. The rogue server responds to DHCP discover messages before the legitimate server, assigning clients a malicious default gateway and DNS server. Which traffic interception technique is being used?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GXPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GXPN” is a trademark of its owner, used for identification only.

Traffic Interception and Manipulation GXPN Practice Questions (Page 7)

Questions 31–35

Which countermeasure is effective in preventing ARP spoofing attacks on a network?

A penetration tester is conducting an assessment and wants to perform a MITM attack between a client and a server on a switched network. The tester has a laptop with two network interfaces. Which setup would allow the tester to intercept and forward traffic?

An attacker deploys an unauthorized DHCP server on a network segment. The rogue server responds to DHCP discover messages before the legitimate server, assigning clients a malicious default gateway and DNS server. Which traffic interception technique is being used?

Keep studying — Network and Infrastructure Attacks