CV0-002 · Question #106
An administrator is attempting to troubleshoot an issue between a web server in the DMZ and an internal workstation by reviewing packet captures. Upon inspection, the payloads of the packets are…
The correct answer is A. The administrator has yet to authenticate to the network. If an administrator has not authenticated to a secure network, their packet capture tool might lack the necessary authorization or decryption keys to interpret encrypted or obfuscated payloads, causing them to appear unreadable.
Question
An administrator is attempting to troubleshoot an issue between a web server in the DMZ and an internal workstation by reviewing packet captures. Upon inspection, the payloads of the packets are unreadable. Which of the following could be the cause of this issue?
Options
- AThe administrator has yet to authenticate to the network
- BThe sniffer is located on an incorrect subnet
- CA vulnerability scanner has interfered with the packet capture
- DEnd-to-end encryption is applied on the network
How the community answered
(38 responses)- A74% (28)
- B5% (2)
- C5% (2)
- D16% (6)
Why each option
If an administrator has not authenticated to a secure network, their packet capture tool might lack the necessary authorization or decryption keys to interpret encrypted or obfuscated payloads, causing them to appear unreadable.
In certain secure network environments, an administrator's lack of authentication to the network or a specific monitoring system might prevent the packet capture tool from gaining the necessary privileges or decryption keys to interpret encrypted or obfuscated payloads, rendering them unreadable. This implies that payload visibility is tied to the administrator's authenticated status within the network's security framework.
While a sniffer on an incorrect subnet might not capture the desired traffic, if packets are captured, their payloads' readability is not typically affected by the sniffer's subnet placement, but rather by encryption or corruption.
A vulnerability scanner interfering with packet capture might affect the completeness or accuracy of the capture data, but it typically would not specifically render the payloads of captured packets unreadable.
While end-to-end encryption directly causes payloads to be unreadable, the question focuses on the administrator's authentication status as the cause. If the problem is due to a lack of administrator authentication, it suggests that decryption would be possible with proper credentials, implying a controllable access issue rather than an immutable encryption barrier that is independent of administrative access.
Concept tested: Network troubleshooting - packet capture payload analysis
Topics
Community Discussion
No community discussion yet for this question.