Network Attack Indicators

A user reports “odd” certificate warnings on her web browser this morning whenever she visits Google. Looking at her browser, you see these certificate warnings. Looking at the network traffic, you notice that all HTTP and HTTPS requests from that system are being routed to the same IP regardless of destination. Which of the following attack types are you seeing in this case?

• Evil twin

• Man in the middle

• Disassociation

• MAC cloning

Users are reporting that the wireless network on one side of the building is broken. They can connect but can’t seem to get to the Internet. While investigating, you notice all of the affected users are connecting to an access point you don’t recognize. These users have fallen victim to what type of attack?

• Rogue AP

• WPS

• Bluejacking

• Disassociation

You’re sitting at the airport when your friend gets a message on her phone. In the text is a picture of a duck with the word “Pwnd” as the caption. Your friend doesn’t know who sent the message. Your friend is a victim of what type of attack?

• Snarfing

• Bluejacking

• Quacking

• Collision

All of the wireless users on the third floor of your building are reporting issues with the network. Every 15 minutes, their devices disconnect from the network. Within a minute or so they are able to reconnect. What type of attack is most likely underway in this situation?

• Evil twin

• Jamming

• Domain hijacking

• Disassociation

Your e-commerce site is crashing under an extremely high traffic volume. Looking at the traffic logs, you see tens of thousands of requests for the same URL coming from hundreds of different IP addresses around the world. What type of attack are you facing?

• Domain hijacking

• DDoS

• DNS poisoning

• URL redirection

A user wants to know if the network is down because she is unable to connect to anything. While troubleshooting, you notice the MAC address for her default gateway setting doesn’t match the MAC address of your organization’s router. What type of attack has been used against this user?

• MAC cloning

• ARP poisoning

• Disassociation

• Rogue access point

You have a helpdesk ticket for a system that is acting strangely. Looking at the system remotely, you see the following in the browser cache: www.micros0ft.com/office. What type of attack are you seeing?

• PowerShell

• Domain hijacking

• URL redirection

• Disassociation

You are seeing a bunch of PDFs flood people’s inboxes with titles such as “New Tax Rates for 2021.” What attack vector is most likely in use?

• Python

• Macro

• Man in the middle

• DDoS

When you update your browser, you get a warning about a plugin not being compatible with the new version. You do not recognize the plugin, and you aren’t sure what it does. Why is it important to understand plugins? What attack vector can be involved in plugins?

• Man in the middle attack

• Domain hijacking attack

• Man in the browser attack

• URL redirection attack

Your network scan is showing a large number of address changes to the MAC tables and lots of ARP and RARP messages. What is happening?

• MAC flooding attack

• Disassociation attack

• Jamming attack

• DNS poisoning