nerdexam
CompTIA

CAS-002 · Question #671

The helpdesk is receiving multiple calls about slow and intermittent Internet access from the finance department. The network administrator reviews the tickets and compiles the following information…

The correct answer is A. A man in the middle attack is underway-implementing static ARP entries is a possible. The network capture reveals ARP spoofing in progress, where a rogue device is claiming to be the default gateway with a MAC address that does not match the actual router.

Enterprise Security

Question

The helpdesk is receiving multiple calls about slow and intermittent Internet access from the finance department. The network administrator reviews the tickets and compiles the following information for the security administrator:

------ Caller 1, IP 172.16.35.217, NETMASK 255.255.254.0 Caller 2, IP 172.16.35.53, NETMASK 255.255.254.0 Caller 3, IP 172.16.35.173, NETMASK 255.255.254.0 All callers are connected to the same switch and are routed by a router with five built-in interfaces. The upstream router interface's MAC is 00-01-42-32-ab-1a The security administrator brings a laptop to the finance office, connects it to one of the wall jacks, starts up a network analyzer, and notices the following:

09:05:10.937590 arp reply 172.16.34.1 is-at 0:12:3f:f1:da:52 (0:12:3f:f1:da:52) 09:05:15.934840 arp reply 172.16.34.1 is-at 0:12:3f:f1:da:52 (0:12:3f:f1:da:52) 09:05:19.931482 arp reply 172.16.34.1 is-at 0:12:3f:f1:da:52 (0:12:3f:f1:da:52) Which of the following can the security administrator determine from the above information?

Options

  • AA man in the middle attack is underway-implementing static ARP entries is a possible
  • BAn ARP flood attack targeted at the router is causing intermittent
  • CThe default gateway is being spoofed-implementing static routing with MD5 is a possible
  • DThe router is being advertised on a separate network-router reconfiguration is a possible

How the community answered

(58 responses)
  • A
    67% (39)
  • B
    10% (6)
  • C
    5% (3)
  • D
    17% (10)

Why each option

The network capture reveals ARP spoofing in progress, where a rogue device is claiming to be the default gateway with a MAC address that does not match the actual router.

AA man in the middle attack is underway-implementing static ARP entries is a possibleCorrect

The ARP reply advertises 172.16.34.1 (the default gateway) as MAC 0:12:3f:f1:da:52, which differs from the actual upstream router MAC 00-01-42-32-ab-1a, confirming ARP poisoning. This causes all finance department clients to forward outbound traffic to the attacker's machine instead of the real router, explaining the slow and intermittent Internet access. Implementing static ARP entries on hosts or Dynamic ARP Inspection on switches prevents clients from accepting falsified ARP replies.

BAn ARP flood attack targeted at the router is causing intermittent

An ARP flood attack generates high volumes of ARP requests to overflow a switch's CAM table, but the capture shows a single targeted ARP reply, not flood-level traffic.

CThe default gateway is being spoofed-implementing static routing with MD5 is a possible

While the default gateway IP is being spoofed via ARP, static routing with MD5 addresses routing protocol integrity, not ARP-layer poisoning on the local segment.

DThe router is being advertised on a separate network-router reconfiguration is a possible

The evidence shows a local ARP spoofing attack on the segment, not the router advertising itself on a different network, making router reconfiguration an incorrect diagnosis.

Concept tested: ARP spoofing detection and man-in-the-middle mitigation

Source: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SY/configuration/guide/sy_swcg/dynamic_arp_inspection.html

Topics

#ARP poisoning#man-in-the-middle attack#network forensics#ARP spoofing

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CAS-002 Practice