PT0-002 · Question #125
Click the exhibit button. A penetration tester is performing an assessment when the network administrator shows the tester a packet sample that is causing trouble on the network. Which of the…
The correct answer is B. ARP spoofing. The penetration tester should stop ARP spoofing, as it involves manipulating ARP tables to misdirect network traffic, a common cause of network disruptions and 'trouble on the network'.
Question
Click the exhibit button. A penetration tester is performing an assessment when the network administrator shows the tester a packet sample that is causing trouble on the network. Which of the following types of attacks should the tester stop?
Exhibit
Options
- ASNMP brute forcing
- BARP spoofing
- CDNS cache poisoning
- DSMTP relay
How the community answered
(22 responses)- A18% (4)
- B73% (16)
- C5% (1)
- D5% (1)
Why each option
The penetration tester should stop ARP spoofing, as it involves manipulating ARP tables to misdirect network traffic, a common cause of network disruptions and 'trouble on the network'.
SNMP brute forcing is an attempt to guess credentials for network device management and typically does not cause direct network traffic disruption or 'trouble' in the same manner.
ARP spoofing is a network-layer attack where an attacker sends forged ARP (Address Resolution Protocol) messages over a local area network, associating the attacker's MAC address with the IP address of a legitimate device. This redirects traffic, causing network disruptions and enabling Man-in-the-Middle attacks, directly leading to 'trouble on the network.'
DNS cache poisoning manipulates DNS resolution to redirect traffic to malicious sites, but its immediate impact on general network operation is less direct than ARP spoofing's traffic misdirection.
SMTP relay involves using an SMTP server to send emails, often unsolicited, which is a service abuse but not a network-layer attack causing broad network 'trouble'.
Concept tested: Network attacks - ARP spoofing
Source: https://attack.mitre.org/techniques/T1557/002/
Topics
Community Discussion
No community discussion yet for this question.
