CAS-003 · Question #620
A security administrator receives reports that several workstations are unable to access resources within one network segment. A packet capture shows the segment is flooded with ICMPv6 traffic from…
The correct answer is D. Deploy ARP spoofing prevention on routers and switches. The observed traffic - ICMPv6 from a link-local address (fe80::/10) to ff02::1 (the all-nodes multicast address) - is consistent with a Neighbor Discovery Protocol (NDP) spoofing or flooding attack, which is the IPv6 equivalent of ARP spoofing. NDP is used for address…
Question
A security administrator receives reports that several workstations are unable to access resources within one network segment. A packet capture shows the segment is flooded with ICMPv6 traffic from the source fe80::21ae;4571:42ab:1fdd and for the destination ff02::1. Which of the following should the security administrator integrate into the network to help prevent this from occurring?
Options
- ARaise the dead peer detection interval to prevent the additional network chatter
- BDeploy honeypots on the network segment to identify the sending machine.
- CEnsure routers will use route advertisement guards.
- DDeploy ARP spoofing prevention on routers and switches.
How the community answered
(43 responses)- A7% (3)
- B23% (10)
- C14% (6)
- D56% (24)
Explanation
The observed traffic - ICMPv6 from a link-local address (fe80::/10) to ff02::1 (the all-nodes multicast address) - is consistent with a Neighbor Discovery Protocol (NDP) spoofing or flooding attack, which is the IPv6 equivalent of ARP spoofing. NDP is used for address resolution, router discovery, and neighbor reachability in IPv6 networks; malicious NDP messages can poison neighbor caches and redirect traffic. Deploying ARP/NDP spoofing prevention (Dynamic ARP Inspection and its IPv6 equivalent, ND Inspection) on routers and switches validates NDP messages against a trusted binding table, dropping the forged ICMPv6 packets and stopping the flood. Option C (RA Guard) addresses router advertisement spoofing specifically but is narrower in scope. Options A and B do not mitigate the attack.
Topics
Community Discussion
No community discussion yet for this question.