312-50V12 · Question #272
Which type of attack attempts to overflow the content-addressable memory (CAM) table in an Ethernet switch?
The correct answer is D. MAC flooding. MAC flooding is a type of attack that overwhelms an Ethernet switch's content-addressable memory (CAM) table, causing it to revert to a hub-like behavior and broadcast all unknown unicast traffic.
Question
Options
- ADDoS attack
- BEvil twin attack
- CDNS cache flooding
- DMAC flooding
How the community answered
(26 responses)- A4% (1)
- B4% (1)
- D92% (24)
Why each option
MAC flooding is a type of attack that overwhelms an Ethernet switch's content-addressable memory (CAM) table, causing it to revert to a hub-like behavior and broadcast all unknown unicast traffic.
A DDoS attack aims to overwhelm a target server, service, or network with a flood of traffic from multiple compromised systems, causing denial of service, rather than specifically overflowing a switch's CAM table.
An evil twin attack involves a rogue Wi-Fi access point that mimics a legitimate one to trick users into connecting and exposing their data, unrelated to Ethernet switch CAM tables.
DNS cache flooding (or poisoning) attempts to inject malicious or incorrect data into a DNS resolver's cache to redirect users to fraudulent websites, not to overflow a switch's CAM table.
MAC flooding attacks involve sending a large number of frames with unique, spoofed MAC source addresses to an Ethernet switch. This rapid influx of addresses quickly exhausts the limited capacity of the switch's CAM table. Once the CAM table is full, the switch can no longer learn new MAC addresses and is forced to broadcast unknown unicast frames out all ports, allowing an attacker to capture traffic intended for other devices.
Concept tested: MAC flooding attack mechanism on Ethernet switches
Source: https://www.cisco.com/c/en/us/support/docs/switches/catalyst-6500-series-switches/23674-mac-spoof.html
Topics
Community Discussion
No community discussion yet for this question.