Network Attacks Flashcards
(195 cards)
1
Q
What security attribute is lost when attackers read private data?
A
Confidentiality
2
Q
Always-on, internet-connected networks increase what factor?
A
Exposure
3
Q
Three-letter model of Confidentiality, Integrity, Availability
A
CIA
4
Q
Which CIA pillar is harmed by service outages?
A
Availability
5
Q
Core aim of a denial-of-service campaign
A
Disruption
6
Q
Attack that floods a target from one host
A
DoS
7
Q
Attack that floods from many hosts at once
A
DDoS
8
Q
Network resource exhausted by a TCP SYN flood
A
Memory
9
Q
Which TCP handshake leg never arrives in a SYN flood?
A
ACK
10
Q
Technique that hides the real sender in a SYN flood
A
IP spoofing
11
Q
ICMP echo-reply storm abusing broadcasts
A
Smurf attack
12
Q
Edge rule that blocks Smurf amplification
A
Disable directed-broadcast
13
Q
Group of compromised machines awaiting orders
A
Botnet
14
Q
One infected botnet member
A
Zombie
15
Q
Server issuing botnet commands
A
C2
16
Q
Unexpected cloud bill after huge DDoS traffic
A
Cost spike
17
Q
Switch memory mapping MAC→port
A
CAM table
18
Q
Attack that overwhelms a switch with fake MACs
A
MAC flooding
19
Q
Switch behavior when CAM is full
A
Broadcast all
20
Q
NIC mode needed to sniff flooded traffic
A
Promiscuous
21
Q
Switch feature limiting learned MACs per port
A
Port security
22
Q
Easy hardening step for idle switch jacks
A
Disable unused ports
23
Q
Layer where Address Resolution Protocol works
A
Layer 2
24
Q
ARP maps an IP address to what?
A
MAC
25
Sending fake ARP replies to one victim
ARP spoofing
26
Corrupting many ARP caches on a LAN
ARP poisoning
27
Switch feature validating ARP packets
DAI
28
Trusted list DAI builds from DHCP snooping
Binding table
29
Segmenting LANs into VLANs limits what attack scope?
Broadcast domain
30
Encrypting traffic defeats sniffing after ARP abuse
TLS/SSL
31
Logical LAN created with 802.1Q tagging
VLAN
32
Attack slipping traffic into another VLAN with two tags
Double tagging
33
Outer VLAN tag in a double-tag frame
Native VLAN
34
Changing the native VLAN to unused ID thwarts
Double tagging
35
Protocol auto-negotiating trunks on Cisco
DTP
36
Impersonating a switch to form a trunk
Switch spoofing
37
Static “switchport mode access” blocks which abuse?
Unauthorized trunk
38
Overflowing CAM to leak traffic across VLANs
CAM flooding
39
Global system translating names to IPs
DNS
40
Injecting false records into resolver cache
DNS poisoning
41
DNS security extension adding digital signatures
DNSSEC
42
DDoS method turning small DNS queries into big replies
Amplification
43
Hiding other protocols inside DNS messages
DNS tunneling
44
Unauthorized change of domain registration
Domain hijacking
45
Stealing full zone data via AXFR
Zone transfer attack
46
Cryptographic control securing zone transfers
TSIG
47
Positioning oneself between client and server
MitM
48
Replay attack does what with captured packets?
Re-sends
49
Relay attack forwards traffic in
Real time
50
Downgrading HTTPS to HTTP for spying
SSL stripping
51
Forcing negotiation of weak encryption
Downgrade attack
52
Fake Wi-Fi AP mimicking a trusted SSID
Evil twin
53
Policy engine blocking unknown devices
NAC
54
Any hardware added without approval
Rogue device
55
Inline hardware copying packets
Network tap
56
Following someone into secure area unnoticed
Tailgating
57
Entering with permission but against policy
Piggybacking
58
Reading passwords off a coworker’s screen
Shoulder surfing
59
Searching trash for sensitive info
Dumpster diving
60
Mass fraudulent email blast
Phishing
61
Targeted fraudulent email at one person/org
Spear phishing
62
Phish aimed at executives
Whaling
63
Malicious code needing user run and infecting files
Virus
64
Self-replicating malware needing no user
Worm
65
Legit-looking app hiding malicious code
Trojan
66
Malware encrypting data for payment
Ransomware
67
Software silently gathering user info
Spyware
68
Program recording every keystroke
Keylogger
69
Stealth kit giving hidden root access
Rootkit
70
Which malware family builds giant botnets?
Worms
71
Conficker exploited which 2008 flaw?
MS08-067
72
Single-word goal of ransomware gangs
Extortion
73
Social engineering preys on human
Trust
74
Most effective counter to social scams
Training
75
Door badge check enforces which concept?
Access control
76
Crosscut shredder mitigates
Dumpster intel
77
First step in any ARP attack
Network scan
78
Non-scalable ARP defense for tiny LANs
Static entries
79
Switch option “sticky” remembers what?
MAC addresses
80
DNS record holding DNSSEC public keys
DNSKEY
81
DDoS reflected UDP replies often have what ratio?
High amplification
82
Service offloading web to edge nodes versus DDoS
CDN
83
Best layer to filter ICMP floods
Edge firewall
84
Portable Wi-Fi pineapple inside office equals
Rogue AP
85
Overheard hallway chat leaking secrets is
Eavesdropping
86
Policy forcing encrypted web only
HSTS
87
Tool “macof” automates which switch attack?
MAC flooding
88
Command “switchport port-security maximum 2” sets
MAC limit
89
Spike of outbound DNS may signal
Data exfiltration
90
Handshake phase abused in downgrade attacks
Negotiation
91
TCP SYN flood counter encoding state in sequence
SYN cookies
92
DNS TXT records often carry hidden
C2 commands
93
Router setting “no ip directed-broadcast” blocks
Smurf
94
IDS alert: burst of new MACs hints at
CAM flood
95
ARP poisoning sets stage for bigger attack type
MitM
96
Malware hiding in firmware before OS boots
Bootkit
97
Quarterly physical walk-throughs catch
Rogue gear
98
Common UDP port for DNS amplification
53
99
SSL stripping forces traffic to which port?
80
100
MitM violates which two CIA pillars?
Confidentiality & Integrity
101
Virus vs worm: which requires user action?
Virus
102
Highest Windows privilege a rootkit seeks
SYSTEM
103
Simulated phish campaigns raise
Awareness
104
Unusually long DNS queries suggest
Tunneling
105
ARP broadcast packet opcode asks
Who-has
106
Switch “violation shutdown” stops
Port abuse
107
MITRE ATT&CK tactic covering phishing
Initial Access
108
Tool “Yersinia” targets protocols like
STP
109
DNS amplification leverages which transport?
UDP
110
Keylogger payload often delivered via
Trojan
111
Network segmentation reduces blast radius of
Attacks
112
Central IP contacted by zombies
C2
113
DNSSEC adds what to DNS responses?
Signature
114
Firewall “deny ip any broadcast” blocks
Smurf
115
Unapproved printer appearing on LAN is a
Rogue device
116
Self-spreading property unique to
Worms
117
Root in Unix equals which Windows account?
Administrator
118
ARP request asks, “Who has”
IP address
119
Phishing often uses what urgency emotion?
Fear
120
Dynamic ARP Inspection relies first on
DHCP snooping
121
Default VLAN number on many switches
1
122
Open recursive DNS servers enable
Amplification
123
Best cure when rootkit found
Reimage
124
Padlock missing in browser warns of
SSL stripping
125
Bot herder issues orders via
C2
126
Large DNS reply sent to victim unsolicited
Amplification
127
Primary defense enabling DNS trust
DNSSEC
128
Shredding prevents info leaks during
Disposal
129
In phishing, “account suspended” creates
Pressure
130
Switch hardening: turn off auto-protocol
DTP
131
Policy verifying only approved software runs
Whitelisting
132
Malware disguised as useful program
Trojan
133
Firmware-level rootkit also called
Bootkit
134
One-time suspicious link in email likely
Phish
135
Patch management strongly counters
Worms
136
VPN tunnel protects against open-Wi-Fi
MitM
137
Abnormal outbound DNS volume implies
Exfiltration
138
Botnet handler traffic often seen on port
4444
139
Port security “violation restrict” will
Limit packets
140
“Sticky secure MAC” survives
Reboots
141
Native VLAN should carry
No user traffic
142
Evil twin AP often uses stronger
Signal
143
Attack chain: phish → malware → botnet →
DDoS
144
Mobile OS asking for unknown cert may show
MitM
145
Keylogger defense needing extra device
Hardware token
146
Default creds on IoT open door to
Rogue device
147
Subnetting aids security through
Isolation
148
Backward-compatible cipher suites invite
Downgrade
149
Recommended frequency for security training
Annual
150
Counting SYNs vs ACKs detects
SYN flood
151
All-channel Wi-Fi jammer causes
DoS
152
Switch control-plane protection stops excess
Protocol abuse
153
Zone transfer limited by ACL on
Name server
154
ARP spoof detection tool checks for
IP-MAC mismatch
155
Slowloris targets which protocol?
HTTP
156
Disabling “ip directed-broadcast” is done on
Routers
157
DNS cache poisoning usually targets which record?
A
158
Using nonce prevents which attack?
Replay
159
Many new MACs in logs indicate
MAC flooding
160
Disposable email links reduce
Phish success
161
Wireless tailgating by cloned badge
Cloning
162
DNS amplification sometimes abuses record type
ANY
163
Standard port for HTTPS
443
164
Ending a TCP connection frees what resource?
Socket
165
Plaintext password theft easiest via
MitM
166
Rootkit removal typically requires
Clean install
167
Attacker holds door while carrying boxes—this is
Piggybacking
168
DNS tunneling often hides what kind of data?
C2/exfiltration
169
Switch “port-security aging” helps counter
MAC churn
170
DNSKEY record stores a zone’s
Public key
171
DHCP starvation is a form of
DoS
172
Dual-tag VLAN hop affects which direction?
Outbound only
173
IDS signature “X-Anubis” likely flags a
Botnet C2
174
SSL stripping replaced by HSTS+
Preload list
175
Static ARP entry downside
Not scalable
176
Primary botnet earnings method besides DDoS
Spam
177
Secure deletion tool for drives
Wipe
178
Tailgating defense using
Mantrap
179
Ransomware target selecting high value
Whaling (in context)
180
Replay protection in Wi-Fi uses
Nonce & timestamp
181
Evil twin lure offering
Free fast Wi-Fi
182
Double tagging relies on switch
Native VLAN stripping
183
MITM on HTTPS stopped by
Certificate pinning
184
DNS resolver randomizes what to thwart poisoning?
Source port
185
Backdoor vs Trojan key difference
Installed purpose
186
DoS via many half-open HTTP headers
Slowloris
187
NAC uses posture checks for
Compliance
188
Zone file enumeration helps attacker in
Reconnaissance
189
CAM flood first fills switch
MAC table
190
C2 server hidden via
DNS tunneling
191
“Smishing” is phishing over
SMS
192
IoT patching difficulty leads to
Botnet recruitment
193
ARP poisoning tool “arp-spoof” in suite
Dsniff
194
Most common SMTP phish attachment type
PDF
195
Amplification attack measurement
Response/request ratio
