nerdexam
CompTIA

CAS-002 · Question #121

An administrator receives reports that the network is running slow for users connected to a certain switch. Viewing the network traffic, the administrator reviews the following: 18:51:59.042108 IP…

The correct answer is B. Improper network zoning. The packet capture shows iSCSI storage traffic mixed with workstation DNS traffic on the same network segment, indicating that storage and user traffic have not been separated into proper network zones.

Research and Analysis

Question

An administrator receives reports that the network is running slow for users connected to a certain switch. Viewing the network traffic, the administrator reviews the following:

18:51:59.042108 IP linuxwksta.55467 > dns.company.com.domain: 39462+ PTR? 222.17.4.10.in-addr.arpa. (42) 18:51:59.055732 IP dns.company.com.domain > linuxwksta.55467: 39462 NXDomain 0/0/0 (42) 18:51:59.055842 IP linuxwksta.48287 > dns.company.com.domain: 46767+ PTR? 255.19.4.10.in-addr.arpa. (42) 18:51:59.069816 IP dns.company.com.domain > linuxwksta.48287: 46767 NXDomain 0/0/0 (42) 18:51:59.159060 IP linuxwksta.42491 > 10.4.17.72.iscsi-target: Flags [P.], seq 1989625106:1989625154, ack 2067334822, win 1525, options [nop,nop,TS val 16021424 ecr 215646227], length 48 18:51:59.159145 IP linuxwksta.48854 > dns.company.com.domain: 3834+ PTR? 72.17.4.10.in-addr.arpa. (41) 18:51:59.159314 IP 10.4.17.72.iscsi-target > linuxwksta.42491: Flags [P.], seq 1:49, ack 48, win 124, options [nop,nop,TS val 215647479 ecr 16021424], length 48 18:51:59.159330 IP linuxwksta.42491 > 10.4.17.72.iscsi-target: Flags [.], ack 49, win 1525, options [nop,nop,TS val 16021424 ecr 215647479], length 0 18:51:59.165342 IP dns.company.com.domain > linuxwksta.48854: 3834 NXDomain 0/0/0 (41) 18:51:59.397461 ARP, Request who-has 10.4.16.58 tell 10.4.16.1, length 46 18:51:59.397597 IP linuxwksta.37684 > dns.company.com.domain: 15022+ PTR? 58.16.4.10.in-addr.arpa. (41) Given the traffic report, which of the following is MOST likely causing the slow traffic?

Options

  • ADNS poisoning
  • BImproper network zoning
  • CARP poisoning
  • DImproper LUN masking

How the community answered

(58 responses)
  • A
    5% (3)
  • B
    59% (34)
  • C
    22% (13)
  • D
    14% (8)

Why each option

The packet capture shows iSCSI storage traffic mixed with workstation DNS traffic on the same network segment, indicating that storage and user traffic have not been separated into proper network zones.

ADNS poisoning

DNS poisoning would be evidenced by DNS responses returning manipulated IP addresses, not NXDomain errors, which simply indicate that no reverse lookup record exists for the queried address.

BImproper network zoningCorrect

Improper network zoning is evidenced by iSCSI target traffic appearing on the same segment as workstation DNS queries - storage area network traffic must reside on a dedicated VLAN or subnet isolated from end-user traffic, and mixing the two creates congestion that degrades network performance for all users on that switch.

CARP poisoning

ARP poisoning manifests as unexpected ARP replies mapping an IP to an attacker's MAC address, which is not present anywhere in the captured traffic.

DImproper LUN masking

Improper LUN masking is a storage access control misconfiguration that allows unauthorized hosts to access volumes, but it would not cause general network slowness or appear in standard packet captures.

Concept tested: Network segmentation and iSCSI traffic zone isolation

Source: https://csrc.nist.gov/publications/detail/sp/800-82/rev-3/final

Topics

#DNS PTR queries#traffic analysis#network zoning#packet capture

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CAS-002 Practice