PT0-001 · Question #233
A penetration tester is connected to a client's local network and wants to passively identify cleartext protocols and potentially sensitive data being communicated across the network. Which of the…
The correct answer is C. Run an MITM attack. A man-in-the-middle attack redirects network traffic through the attacker's machine, providing direct visibility into cleartext protocols and sensitive data being transmitted between hosts.
Question
A penetration tester is connected to a client's local network and wants to passively identify cleartext protocols and potentially sensitive data being communicated across the network. Which of the following is the BEST approach to take?
Options
- ARun a network vulnerability scan.
- BRun a stress test.
- CRun an MITM attack.
- DRun a port scan.
How the community answered
(35 responses)- A3% (1)
- B9% (3)
- C86% (30)
- D3% (1)
Why each option
A man-in-the-middle attack redirects network traffic through the attacker's machine, providing direct visibility into cleartext protocols and sensitive data being transmitted between hosts.
A network vulnerability scan actively probes hosts for known weaknesses and open ports but does not capture or analyze the content of traffic flowing between endpoints.
A stress test generates high-volume traffic to assess system stability and has no mechanism for identifying or capturing data from existing network communications.
An MITM attack - typically executed via ARP cache poisoning on a switched network - intercepts and relays traffic between two hosts, allowing full inspection of all communication content. This is the only technique among the choices that exposes the actual data payload, enabling identification of cleartext protocols such as Telnet, FTP, and HTTP and capture of credentials or sensitive information in transit. Scanning techniques reveal services but never the content of communications.
A port scan enumerates open ports and services on target hosts but provides no visibility into the actual data being transmitted across those connections.
Concept tested: MITM attack for cleartext protocol identification
Source: https://attack.mitre.org/techniques/T1557/
Topics
Community Discussion
No community discussion yet for this question.