nerdexam
GIAC

GCIH · Question #215

Which of the following steps can be taken as countermeasures against sniffer attacks? Each correct answer represents a complete solution. Choose all that apply.

The correct answer is A. Use encrypted protocols for all communications. B. Use switches instead of hubs since they switch communications, which means that. Using encrypted protocols and deploying switches instead of hubs are effective countermeasures that prevent sniffers from capturing or reading network traffic.

Incident Response & Cyber Kill Chain

Question

Which of the following steps can be taken as countermeasures against sniffer attacks? Each correct answer represents a complete solution. Choose all that apply.

Options

  • AUse encrypted protocols for all communications.
  • BUse switches instead of hubs since they switch communications, which means that
  • CUse tools such as StackGuard and Immunix System to avoid attacks.
  • DReduce the range of the network to avoid attacks into wireless networks.

How the community answered

(47 responses)
  • A
    94% (44)
  • C
    2% (1)
  • D
    4% (2)

Why each option

Using encrypted protocols and deploying switches instead of hubs are effective countermeasures that prevent sniffers from capturing or reading network traffic.

AUse encrypted protocols for all communications.Correct

Encrypting all communications with protocols such as TLS or SSH ensures that even if a sniffer captures packets, the payload data remains unreadable without the decryption keys, neutralizing the threat at the data confidentiality level.

BUse switches instead of hubs since they switch communications, which means thatCorrect

Switches forward frames only to the specific port of the intended recipient based on MAC addresses, unlike hubs which broadcast all traffic to every connected port, drastically reducing the data visible to any potential sniffer on the network.

CUse tools such as StackGuard and Immunix System to avoid attacks.

StackGuard and Immunix System are memory protection tools designed to detect and prevent buffer overflow exploits, not countermeasures against packet sniffing on a network.

DReduce the range of the network to avoid attacks into wireless networks.

Reducing the wireless signal range may limit physical access to the airspace but does not prevent sniffing by anyone already within range and provides no protection against sniffing on wired network segments.

Concept tested: Countermeasures against network packet sniffing

Source: https://csrc.nist.gov/publications/detail/sp/800-115/final

Topics

#sniffer countermeasures#encryption#network switches#traffic interception

Community Discussion

No community discussion yet for this question.

Full GCIH Practice