Module 08 - Sniffing

Question 1

In one of the following techniques, a non-broadcast ARP is sent to all the nodes in a network, and a node running in the promiscuous mode broadcasts a ping message on the network with the local IP address but a different MAC address. Which is this technique?

A) ARP method
B) ARP spoofing
C) ARP poisoning
D) Ping method

Answer 1

A) ARP method

Question 2

Which of the following threats of ARP poisoning links multiple IP addresses with a single MAC address of a target host intended for different IP addresses and overloads it with a huge amount of traffic?

A) VoIP call tapping
B) DoS attack
C) Session hijacking
D) MITM attack

Answer 2

B) DoS attack

Question 3

Which of the following protocols is not vulnerable to sniffing?

A) Post office protocol (POP)
B) Telnet and Rlogin
C) Secure sockets layer (SSL)
D) Hypertext transfer protocol (HTTP)

Answer 3

C) Secure sockets layer (SSL)

Question 4

A network administrator wants to configure port security on a Cisco switch. Which of the following commands helps the administrator to enable port security on an interface?

A) switchport port-security
B) switchport port-security maximum 1
C) switchport port-security aging type inactivity
D) switchport port-security aging time 2

Answer 4

A) switchport port-security

Question 5

Sniffers work at which of the following open systems interconnect (OSI) layers?

A) data link layer
B) presentation layer
C) transport layer
D) application layer

Answer 5

A) data link layer

Question 6

Which of the following countermeasures should be followed to defend against sniffing?

A) use dynamic IP addresses and ARP tables
B) allow SSID broadcasting
C) turn on network identification broadcasts
D) use HTTPS to protect usernames and passwords

Answer 6

D) use HTTPS to protect usernames and passwords

Question 7

Which of the following security measures should be followed to defend against DNS spoofing?

A) allow DNS requests being sent to external servers
B) avoid using DNS non-existent (NXDOMAIN) rate limiting
C) do not restrict DNS zone transfers to a limited set of IP addresses
D) restrict the DNS recusing service, either fully or partially, to authorized users

Answer 7

D) restrict the DNS recusing service, either fully or partially, to authorized users

Question 8

Which of the following IOS Global commands is used to configure the number of DHCP packets per second (pps) that an interface can receive?

A) show ip dhcp snooping
B) ip dhcp snooping limit rate
C) ip dhcp snooping
D) ip dhcp snooping trust

Answer 8

B) ip dhcp snooping limit rate

Question 9

A hacker, who posed as a heating and air conditioning specialist, was able to install a sniffer program in a switched environment network. Which attack could have been used by the hacker to sniff all of the packets in the network?

A) MAC flood attack
B) fraggle attack
C) teardrop attack
D) smurf attack

Answer 9

A) MAC flood attack

Question 10

A tester wants to securely encrypt the session to prevent the network against a sniffing attack. Which of the following protocols should he use as a replacement of Telnet?

A) Load balancing (LB)
B) SSH
C) Public key infrastructure (PKI)
D) Intrusion prevention system (IPS)

Answer 10

B) SSH

Question 11

Which of the following display filters in Wireshark is used by an attacker to perform filtering by multiple IP addresses?

A) ip.addr == 10.0.0.4 or ip.addr == 10.0.05
B) tcp.analysis. retransmission
C) ip.addr==192.168.1.100 && tcp.port=23
D) ip.src != xxx.xxx.xxx.xxx && ip.dst != xxx.xxx.xxx.xxx && sip

Answer 11

A) ip.addr == 10.0.0.4 or ip.addr == 10.0.05

Question 12

Which of the following techniques is used by an attacker to connect a rogue switch to the network by tricking a legitimate switch and thereby creating a trunk link between them?

A. switch spoofing
B. double tagging
C. switch port stealing
D. IRDP spoofing

Answer 12

A. switch spoofing

Question 13

Which of the following measures should NOT be followed to prevent DNS spoofing attacks?

A) Implement an intrusion detection system (IDS) and deploy it correctly
B) allow outgoing traffic to use UDP port 53 as a default source port
C) secure internal machines
D) maintain a single or specific range of IP addresses to login to the systems

Answer 13

B) allow outgoing traffic to use UDP port 53 as a default source port

Question 14

Which of the following techniques is also a type of network protocol for PNAC that is used to defend against MAC address spoofing and to enforce access control at the point where a user joins the network?

A) IEEE 802.1X suites
B) DHCP snooping binding table
C) IP source guard
D) Dynamic ARP inspection

Answer 14

A) IEEE 802.1X suites

Question 15

Which of the following IPv4 DHCP packet fields includes a random number chosen by a client to associate requests messages and their responses between the client and server?

A) SNAME
B) Flags
C) Transaction ID (XID)
D) Opcode

Answer 15

C) Transaction ID (XID)

Question 16

Which of the following tools can a tester use to detect system that runs in promiscuous mode, which in turns helps to detect sniffers installed on the network?

A. FaceNiff
B. Nmap
C. OmniPeek
D. shARP

Answer 16

B. Nmap

Question 17

Which of the following techniques is used by attackers to compromise the security of network switches that connect network segments and force a switch to act as a hub to sniff the traffic easily?

A. ARP spoofing
B. Switch spoofing
C. Wiretapping
D. MAC flooding

Answer 17

D. MAC flooding

Question 18

Which of the following fields in an IPv4 DHCP message has a size of 128 octets?

A. Hardware address length
B. Gateway IP address (GIADDR)
C. Server name (SNAME)
D. File name

Answer 18

D. File name

Question 19

Which of the following tools helps an attacker capture all the data transmitted over a network and perform expert analysis of each part of the target network?

A) ike-scan
B. OmniPeek
C. DerpNSpoof
D. Spoof-Me-Now

Answer 19

B. OmniPeek

Question 20

Which of the following protocols allows a user’s workstation to access mail from a mailbox server and send mail from the workstation to the mailbox server via SMTP?

A. SMTP
B. FTP
C. HTTP
D. POP

Answer 20

D. POP

Question 21

Which of the following protocols is used to communicate through port 23 and allows an attacker to login to a network machine remotely via a TCP connection to sniff keystrokes, including usernames and passwords, that are sent in cleartext?

A. HTTP
B. NNTP
C. POP
D. Telnet

Answer 21

D. Telnet

Question 22

Ross, an attacker, targeted an organization’s network to sniff the DNS traffic. For this purpose, he used a DNS poisoning tool that can create a list of fake DNS records and load it while running to redirect a target employee to a malicious website. Which of the following tools did Ross employ in the above scenario?

A. WIBR+
B. Suricata
C. Reaver
D. DerpNSpoof

Answer 22

D. DerpNSpoof

Question 23

Which of the following techniques is an active wiretapping attack that allows an attacker to monitor and record traffic as well as alter or inject data into the communication or traffic?

A. Spying
B. MITM
C. Eavesdropping
D. Snooping

Answer 23

B. MITM

Question 24

Cyrus, a professional hacker, performed an ARP poisoning attack on a target network by using an automated tool. The tool used by Cyrus sends fake ARP messages to divert all communications between two machines so that all traffic is redirected through his machine. Which of the following tools did Cyrus employ in the above scenario?

A. Nexpose
B. OpenVAS
C. Nikto
D. dsniff

Answer 24

A. Nexpose

Question 25

Which of the following is a defense technique for MAC spoofing used in switches that restricts the IP traffic on untrusted Layer 2 ports by filtering traffic based on the DHCP snooping binding database? A. DHCP snooping binding table B. Authentication, authorization, and accounting (AAA) C. Dynamic ARP inspection D. IP Source Guard

Answer 25

D. IP Source Guard