Drag and Drop Question Drag and drop the attack-mitigation techniques from the left onto the types of attack that they mitigate on the right. Answer:

Question

Exhibits

Answer Area

Explanation

Drag-and-Drop Explanation: Attack Mitigation Techniques

The question matches each mitigation technique to the specific attack it defends against. The right-side attack targets (implied by the arrangement) are:

1. Configure the native VLAN with a nondefault VLAN

Mitigates: Double-tagging VLAN-hopping attack

Double-tagging exploits the default native VLAN (VLAN 1). An attacker crafts a frame with two 802.1q tags: the outer tag matches the native VLAN (stripped by the first switch without adding a tag), and the inner tag targets a victim VLAN. The second switch then forwards the frame to that victim VLAN.

Fix: Changing the native VLAN to an unused, non-default VLAN means the attacker's outer tag no longer matches, breaking the attack.

Common misconception: People confuse this fix with the switch-spoofing fix. Double-tagging does not require a trunk - the attacker just needs access to a port on the native VLAN.

2. Configure the DHCP snooping feature

Mitigates: DHCP starvation / DHCP spoofing attack

DHCP starvation floods the server with requests (using spoofed MACs) to exhaust the address pool, then a rogue DHCP server fills the gap, pointing clients to a malicious gateway.

Fix: DHCP snooping designates trusted ports (uplinks to real DHCP servers) and untrusted ports (client-facing). It drops DHCP server responses on untrusted ports and rate-limits client requests.

Common misconception: DHCP snooping does not prevent MAC spoofing broadly - it only validates DHCP traffic specifically.

3. Configure the 802.1x authentication protocol

Mitigates: Unauthorized network access / rogue device attacks

Without port authentication, any device physically plugged into a switch port gets network access. An attacker can connect an unauthorized device and begin lateral movement.

Fix: 802.1x enforces port-based Network Access Control (NAC). A device must authenticate (via RADIUS/EAP) before the port is opened. Unauthenticated devices are blocked or placed in a guest VLAN.

Common misconception: 802.1x does not prevent VLAN hopping - it controls access to the network, not VLAN traversal.

4. Disable Dynamic Trunking Protocol (DTP)

Mitigates: Switch-spoofing VLAN-hopping attack

DTP allows switches to auto-negotiate trunk links. An attacker sends DTP frames to convince the switch their device is another switch, forming a trunk and gaining access to all VLANs.

Fix: Disable DTP on all user-facing ports (switchport nonegotiate or set ports to access mode). Without DTP, the attacker cannot negotiate a trunk.

Common misconception: Simply setting a port to access mode may not be enough on some platforms - explicitly disabling DTP negotiation (nonegotiate) is the complete fix.

Summary Table

The key distinction to remember: both VLAN-hopping attacks (items 1 and 4) are often confused with each other - double-tagging is a passive frame manipulation, while switch-spoofing is an active trunk negotiation attack.

No community discussion yet for this question.