A network administrator suspects that an attacker is performing ARP spoofing on the corporate network. The administrator wants to implement a detection mechanism that can identify ARP spoofing without requiring changes to end-user workstations. Which approach should the administrator use?

Deploy a network-based intrusion detection system (IDS) that monitors ARP traffic for inconsistencies.

Use MAC address filtering on the switch to allow only known devices.

Enable DHCP snooping on the switches to validate DHCP messages.

Configure static ARP entries on all workstations.

A penetration tester is using bettercap on a Linux laptop to perform ARP spoofing and capture HTTP traffic from a target host. The tester wants to also inject a custom HTML payload into the HTTP responses. Which bettercap module should the tester use in addition to the ARP spoofing module?

The arp.spoof module with the --custom-payload flag.

The dns.spoof module with a custom hosts file.

The http.proxy module with a custom JavaScript hook.

The net.sniff module with a custom BPF filter.

GIAC Exploit Researcher and Advanced Penetration Tester

Domain 3Objective 3

Traffic Interception and Manipulation GXPN Practice Questions (Page 8)

Part of the Network and Infrastructure Attacks domain, which makes up ~14% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~10–17 in this domain), expect 3–6 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

6concepts

Questions 36–38

36application · medium
A network administrator suspects that an attacker is performing ARP spoofing on the corporate network. The administrator wants to implement a detection mechanism that can identify ARP spoofing without requiring changes to end-user workstations. Which approach should the administrator use?
Select an answer first
37application · medium
A penetration tester is using bettercap on a Linux laptop to perform ARP spoofing and capture HTTP traffic from a target host. The tester wants to also inject a custom HTML payload into the HTTP responses. Which bettercap module should the tester use in addition to the ARP spoofing module?
Select an answer first
38foundation · easy
An attacker sends forged ARP replies on a local Ethernet segment, causing the switch to update its MAC-to-port mapping so that traffic destined for the default gateway is delivered to the attacker's machine. Which traffic interception technique is being used?
Select an answer first

Finished these 3 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GXPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GXPN” is a trademark of its owner, used for identification only.

Traffic Interception and Manipulation GXPN Practice Questions (Page 8)

Questions 36–38

A network administrator suspects that an attacker is performing ARP spoofing on the corporate network. The administrator wants to implement a detection mechanism that can identify ARP spoofing without requiring changes to end-user workstations. Which approach should the administrator use?

A penetration tester is using bettercap on a Linux laptop to perform ARP spoofing and capture HTTP traffic from a target host. The tester wants to also inject a custom HTML payload into the HTTP responses. Which bettercap module should the tester use in addition to the ARP spoofing module?

An attacker sends forged ARP replies on a local Ethernet segment, causing the switch to update its MAC-to-port mapping so that traffic destined for the default gateway is delivered to the attacker's machine. Which traffic interception technique is being used?

Keep studying — Network and Infrastructure Attacks