CAS-002 · Question #174
The security manager of a company has hired an external consultant to conduct a security assessment of the company network. The contract stipulates that the consultant is not allowed to transmit any…
The correct answer is B. Protocol analyzer. A protocol analyzer passively captures network traffic without transmitting any data, allowing the consultant to identify device manufacturers via MAC address OUI lookups and infer operating systems from traffic fingerprints.
Question
The security manager of a company has hired an external consultant to conduct a security assessment of the company network. The contract stipulates that the consultant is not allowed to transmit any data on the company network while performing wired and wireless security assessments. Which of the following technical means can the consultant use to determine the manufacturer and likely operating system of the company wireless and wired network devices, as well as the computers connected to the company network?
Options
- ASocial engineering
- BProtocol analyzer
- CPort scanner
- DGrey box testing
How the community answered
(46 responses)- A4% (2)
- B87% (40)
- C7% (3)
- D2% (1)
Why each option
A protocol analyzer passively captures network traffic without transmitting any data, allowing the consultant to identify device manufacturers via MAC address OUI lookups and infer operating systems from traffic fingerprints.
Social engineering is a human-based technique rather than a technical means and would not reliably provide systematic information about all network devices and operating systems.
A protocol analyzer operates in a completely passive listen-only mode and does not inject or transmit any packets onto the network, satisfying the contractual no-transmission constraint. By examining captured frames, the analyst can identify device manufacturers from the OUI portion of MAC addresses and fingerprint operating systems based on observed network behavior and protocol implementations. This is the only listed technical tool that gathers the required information without violating the restriction.
A port scanner actively sends probe packets to target systems, which constitutes transmitting data on the network and would directly violate the contractual restriction.
Grey box testing is a testing methodology or engagement type rather than a specific technical tool, and may involve active probing that transmits data.
Concept tested: Passive network reconnaissance using protocol analyzers
Source: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-115.pdf
Topics
Community Discussion
No community discussion yet for this question.