GCIH · Question #133
Which of the following statements are correct about spoofing and session hijacking? Each correct answer represents a complete solution. Choose all that apply.
The correct answer is B. Spoofing is an attack in which an attacker can spoof the IP address or other identity of the D. Session hijacking is an attack in which an attacker takes over the session, and the valid. This question tests the ability to distinguish between spoofing and session hijacking as distinct network attack types based on their correct technical definitions.
Question
Which of the following statements are correct about spoofing and session hijacking? Each correct answer represents a complete solution. Choose all that apply.
Options
- ASpoofing is an attack in which an attacker can spoof the IP address or other identity of the
- BSpoofing is an attack in which an attacker can spoof the IP address or other identity of the
- CSession hijacking is an attack in which an attacker takes over the session, and the valid
- DSession hijacking is an attack in which an attacker takes over the session, and the valid
How the community answered
(38 responses)- A5% (2)
- B92% (35)
- C3% (1)
Why each option
This question tests the ability to distinguish between spoofing and session hijacking as distinct network attack types based on their correct technical definitions.
Choice A presents an incomplete or inaccurate version of the spoofing definition compared to choice B, which is the technically complete and correct statement.
Spoofing is correctly defined as an attack where an adversary falsifies identifying information such as an IP address, MAC address, or sender identity to impersonate a trusted entity. Choice B provides the technically accurate and complete statement of this definition, making it the correct answer over the similar but incomplete choice A.
Choice C presents an incomplete or inaccurate version of the session hijacking definition compared to choice D, which is the technically complete and correct statement.
Session hijacking is correctly defined as an attack where an adversary takes over an already-authenticated session between a client and server, exploiting session tokens or state to assume the legitimate user's identity and access. Choice D provides the accurate and complete description of this attack, making it correct over the similar but incomplete choice C.
Concept tested: Spoofing vs session hijacking attack definitions
Source: https://csrc.nist.gov/glossary/term/spoofing
Topics
Community Discussion
No community discussion yet for this question.