Network Attacks

Question 1

What is a Denial of Service (DoS) Attack?

Answer 1

Occurs when one machine overwhelms a victim system with continuous service requests, leading to resource exhaustion.

Question 2

What does a TCP SYN Flood attack involve?

Answer 2

Initiating multiple TCP sessions without completing them, leading to half-open connections and resource exhaustion.

Question 3

What is the TCP Handshake process?

Answer 3

Involves SYN, SYN/ACK, and ACK packets.

Question 4

How does a SMURF Attack work?

Answer 4

Attacker sends a ping to a subnet broadcast address with a spoofed source IP, causing all devices to respond to the victim server.

Question 5

What is a Distributed Denial of Service (DDoS) Attack?

Answer 5

Involves multiple machines simultaneously overwhelming a single server.

Question 6

What is a Botnet?

Answer 6

A collection of compromised computers under the control of a Command and Control (C2) server.

Question 7

Define ‘Zombie’ in the context of DDoS attacks.

Answer 7

Individually compromised computers within a botnet.

Question 8

What challenges do cloud-based resources present during DDoS attacks?

Answer 8

They can horizontally scale to handle increased demand but may incur substantial costs for illegitimate traffic.

Question 9

What is MAC Flooding?

Answer 9

A network attack technique aimed at compromising a switch’s security by overflowing its MAC table.

Question 10

What is the normal operation of a switch?

Answer 10

Utilizes MAC tables to associate MAC addresses with switchports for efficient data forwarding.

Question 11

What is the implication of Data Snooping in MAC Flooding?

Answer 11

Attackers can capture sensitive data by forcing the switch into hub mode.

Question 12

What is ARP Spoofing?

Answer 12

Occurs when an attacker sends falsified ARP messages, linking their MAC address with a legitimate IP.

Question 13

What is the difference between ARP Spoofing and ARP Poisoning?

Answer 13

ARP Spoofing targets a single host’s traffic, while ARP Poisoning affects all hosts in a LAN.

Question 14

What does VLAN Hopping exploit?

Answer 14

Misconfigurations to gain unauthorized access to different VLANs.

Question 15

What is DNS Cache Poisoning?

Answer 15

Corrupting DNS resolver cache with false information to redirect traffic.

Question 16

What is a common method for mitigating DNS Amplification Attacks?

Answer 16

Limit the size of DNS responses or rate limit DNS response traffic.

Question 17

What is an On-Path Attack?

Answer 17

An attack where the penetration tester places their workstation between two hosts to capture, monitor, and relay communications.

Question 18

What is a Replay Attack?

Answer 18

Occurs when an attacker captures valid data and repeats it either immediately or with a delay.

Question 19

What is a Relay Attack?

Answer 19

An attack where the attacker becomes a proxy between two hosts, intercepting and potentially modifying communications.

Question 20

What are Rogue Devices?

Answer 20

Unauthorized devices or services on a network that allow unauthorized individuals to connect.

Question 21

What is a common method for detecting Rogue Systems?

Answer 21

Visual Inspection, Network Mapping, and Host Discovery.

Question 22

What is Social Engineering?

Answer 22

Any attempt to manipulate users into revealing confidential information or performing actions detrimental to security.

Question 23

What is Phishing?

Answer 23

Sending deceptive emails to trick users into revealing sensitive information.

Question 24

What is the purpose of Dumpster Diving?

Answer 24

Scavenging for personal or confidential information in trash or recycling.

Question 25

What is Malware?

Answer 25

Short-hand term for malicious software designed to infiltrate a computer system.

Question 26

What is a Virus?

Answer 26

Malicious code that infects a computer when run.

Question 27

What does Ransomware do?

Answer 27

Restricts access until a ransom is paid, often by encrypting files or changing passwords.

Question 28

What is a Remote Access Trojan (RAT)?

Answer 28

A type of Trojan that provides the attacker with remote control of a victim's system.

Question 29

What is a Rootkit?

Answer 29

Malware that gains administrative control without detection.

Question 30

What is malware that restricts access until a ransom is paid called?

Answer 30

Ransomware ## Footnote Ransomware encrypts files or changes passwords, demanding payment for access.

Question 31

What notable example of ransomware cost Atlanta over $17 million to fix?

Answer 31

SamSam (2018) ## Footnote SamSam is a specific case of ransomware that had a significant financial impact.

Question 32

What type of malware gathers information without consent?

Answer 32

Spyware ## Footnote Spyware can include various types such as adware and keyloggers.

Question 33

What is adware?

Answer 33

A type of spyware for advertising ## Footnote Adware is designed to display advertisements to users.

Question 34

What is a keylogger?

Answer 34

A type of spyware that captures keystrokes ## Footnote Keyloggers can be used to steal sensitive information like passwords.

Question 35

What is a rootkit?

Answer 35

Malware that gains administrative control without detection ## Footnote Rootkits are particularly difficult to detect and often require booting from an external device to remove.

Question 36

Name one method to prevent malware infections.

Answer 36

Always check files for malware before downloading or installing ## Footnote This is a key practice to avoid malware infections.

Question 37

Why is it important to keep software up to date?

Answer 37

To patch vulnerabilities ## Footnote Regular updates can help protect against known security flaws.

Question 38

What should be used to protect against malware?

Answer 38

Reputable antivirus software and firewalls ## Footnote These tools help detect and prevent malware infections.

Question 39

What is one best practice for user safety regarding malware?

Answer 39

Educate users about safe browsing and downloading practices ## Footnote User awareness is crucial for preventing malware infections.