Refer to the exhibit. A security analyst notices unusual connections while monitoring traffic. What is the attack vector, and which action should be taken to prevent this type of event?

Question

Exhibit

Options

• ADNS spoofing; encrypt communication protocols
• BSYN flooding; block malicious packets
• CARP spoofing; configure port security
• DMAC flooding; assign static entries

• A
  4% (1)
• B
  8% (2)
• C
  85% (22)
• D
  4% (1)

Explanation

The exhibit shows multiple ARP reply packets with the same IP addresses (192.168.51.105 and 192.168.51.201) being mapped to different MAC addresses, which triggers the message: "duplicate use of [IP] detected". This is a strong indicator of an ARP spoofing (or poisoning) attack. ARP spoofing occurs when a malicious actor sends falsified ARP messages to associate their MAC address with the IP address of another host. This misleads other devices on the network and allows interception or redirection of traffic. The Cisco CyberOps Associate guide specifically recommends configuring port security on switches as a method to mitigate ARP spoofing, by limiting the number of MAC addresses allowed per port or statically assigning legitimate MAC addresses to switch ports.

No community discussion yet for this question.