CAS-001 · Question #19
The helpdesk is receiving multiple calls about slow and intermittent Internet access from the finance department. The network administrator reviews the tickets and compiles the following information…
The correct answer is A. A man in the middle attack is underway - implementing static ARP entries is a possible solution. The network capture shows an ARP reply claiming that the gateway IP (172.16.34.1) is at MAC 0:12:3f:f1:da:52. However, the known upstream router interface MAC is 00-01-42-32-ab-1a-a different MAC address. This discrepancy is the signature of ARP cache poisoning (ARP spoofing)…
Question
The helpdesk is receiving multiple calls about slow and intermittent Internet access from the finance department. The network administrator reviews the tickets and compiles the following information for the security administrator:
------ Caller 1, IP 172.16.35.217, NETMASK 255.255.254.0 Caller 2, IP 172.16.35.53, NETMASK 255.255.254.0 Caller 3, IP 172.16.35.173, NETMASK 255.255.254.0 All callers are connected to the same switch and are routed by a router with five built-in interfaces. The upstream router interface's MAC is 00-01-42-32- ab-1a ------ The security administrator brings a laptop to the finance office, connects it to one of the wall jacks, starts up a network analyzer, and notices the following:
09:05:10.937590 arp reply 172.16.34.1 is-at 0:12:3f:f1:da:52 (0:12:3f:f1:da:52) 09:05:15.934840 arp reply 172.16.34.1 is-at 0:12:3f:f1:da:52 (0:12:3f:f1:da:52) 09:05:19.931482 arp reply 172.16.34.1 is-at 0:12:3f:f1:da:52 (0:12:3f:f1:da:52) Which of the following can the security administrator determine from the above information?
Options
- AA man in the middle attack is underway - implementing static ARP entries is a possible solution.
- BAn ARP flood attack targeted at the router is causing intermittent communication - implementing IPS is a
- CThe default gateway is being spoofed - implementing static routing with MD5 is a possible solution.
- DThe router is being advertised on a separate network - router reconfiguration is a possible solution.
How the community answered
(38 responses)- A58% (22)
- B5% (2)
- C13% (5)
- D24% (9)
Explanation
The network capture shows an ARP reply claiming that the gateway IP (172.16.34.1) is at MAC 0:12:3f:f1:da:52. However, the known upstream router interface MAC is 00-01-42-32-ab-1a-a different MAC address. This discrepancy is the signature of ARP cache poisoning (ARP spoofing), where an attacker sends forged ARP replies to associate their own MAC address with the legitimate gateway IP. This redirects all traffic intended for the gateway through the attacker's machine-a classic Man-in-the-Middle (MITM) attack-which explains the slow and intermittent Internet access reported by finance department users. The correct mitigation is to configure static ARP entries on hosts or use Dynamic ARP Inspection (DAI) on managed switches to validate ARP replies against a trusted DHCP binding table.
Topics
Community Discussion
No community discussion yet for this question.