In the WLAN network, which of the following illegal attack detection needs the support of the dynamic blacklist function? (Multiple choice)

Question

Options

• AFlood attack detection
• BSpoof attack detection
• CWeak lV attack detection
• DAnti-brute force cracking

• A
  82% (31)
• B
  8% (3)
• C
  11% (4)

Explanation

Flood attacks (A) and brute-force attacks (D) both require dynamic blacklisting because they involve an identifiable source repeatedly performing malicious actions. In a flood attack, a device sends a massive volume of frames; once detected, that source MAC is automatically added to the blacklist to stop further traffic. In brute-force cracking, an attacker repeatedly tries authentication credentials - after exceeding a failure threshold, the dynamic blacklist automatically blocks that device from further attempts.

Spoof attacks (B) are incorrect because the attacker forges MAC addresses to impersonate legitimate clients. Since the attacker can trivially change the spoofed MAC, blacklisting an address provides no effective defense - the protection relies on detection and alerting mechanisms, not source blocking.

Weak IV attacks (C) are incorrect because this is a passive eavesdropping attack against WEP encryption. The attacker silently collects packets to analyze weak Initialization Vectors - there is no active source to identify and block, making a dynamic blacklist irrelevant. The real fix is abandoning WEP altogether.

Memory tip: Think "Repeat Offenders get Blacklisted." Only attacks where the same identifiable source repeatedly hammers the network (Floods = packet hammering, Brute-force = credential hammering) benefit from dynamic blacklisting. Passive or identity-forging attacks (Weak IV, Spoofing) bypass blacklists entirely.

No community discussion yet for this question.