Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

CompTIA Network+(N10-009) > S15-Network Attacks > Flashcards

S15-Network Attacks Flashcards

1
Q

Denial of Service (DoS) Attack

A

Occurs when one machine is continually flooding a victim with requests for services

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What do attackers typically use to conduct a DoS attack?

A
  • TCP SYN Flood
  • Smurf Attack (ICMP Flood)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

TCP SYN Flood

A

denial-of-service (DoS) attack that exploits the TCP handshake process to overload a server.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

How does a TCP SYN Flood Overload a Server?

A

Attackers send a large number of SYN packets to the server, but they don’t complete the handshake by sending the final ACK packet creating half-open connections

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Smurf Attack (ICMP Flood)

A

type of Distributed Denial-of-Service (DDoS) attack that floods a victim server with ICMP echo request packets.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

How does a Smurf Attack Overload a server?

A

The attacker sends ICMP echo request packets with a spoofed source IP address to the target network’s broadcast address.
Each device on the network responds by sending an ICMP echo reply packet to the spoofed source IP overwhelming the target server with ICMP echo reply packets.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Distributed Denial of Service (DDoS) Attack

A

An attacker uses many computers to make requests to a single server at once

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Botnet

A

Collection of compromised computers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

MAC Flooding

A

MAC flooding is a network attack that exploits a switch’s ability to learn MAC addresses by sending a large number of fake MAC addresses to overwhelm its memory (Mac Table) causing the Switch to behave like a hub and broadcast traffic on all ports.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Why would an attacker want to conduct a MAC flooding attack?

A
  • Data Snooping
  • Disrupting Services
  • Bypassing security measures
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Data Snooping (Mac Flooding)

A

Attacker captures sensitive data by forcing the switch to broadcast traffic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Disrupting Services (Mac Flooding)

A

A Broadcasting switch resulting from a MAC flood attack can overwhelm a network with excessive traffic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Bypassing security measures (Mac Flooding)

A

MAC flooding can bypass security measures like MAC address filtering

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What measures can you take to defend against MAC Flooding

A
  • Use anomaly-based intrusion detection system (IDS)
  • Employ Network monitoring Tools
  • Limit MAC addresses per port through Port security config
  • Set MAC address limits per switchport
  • Use VLANs to segregate traffic
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Address Resolution Protocol (ARP)

A

Protocol that is used to map an IP address to a MAC address on a LAN

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

ARP Spoofing

A

An attacker sends false ARP messages over a LAN in an attempt to associate their MAC address with a target IP address

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

ARP Poisoning

A

Attack that corrupts the ARP cache (ARP table) in the network Targeting all devices in a LAN

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What techniques attackers use to conduct ARP attacks?

A

IP-MAC Scanning:
- Scan for IP-MAC pairs, utilize software to send fake ARP responses

ARP Flood:
- Conduct Arp poisoning through an ARP flood

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

How can you prevent ARP attacks?

A
  • Static ARP Entries
  • Dynamic ARP inspection
  • Network Segmentation
  • VPNs or Encryption Tech.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Static ARP Entries (ARP attacks)

A

Manually inputting ARP mappings to prevent spoofing
- Not scalable

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Dynamic ARP inspection (ARP Attacks)

A

Switches inspect ARP packets, dropping suspicious mappings based on trusted MAC-IP pairs
- Dynamic ARP inspection (DAI) is a feature on most modern switches

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Network Segmentation (ARP Attacks)

A

Dividing the network into smaller segments limits the impact of ARP attacks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

VPNs & Encryption Tech. (ARP Attacks)

A

Safeguard Data against Alterations from successful ARP spoofing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

VLAN

A

Used to Partition and isolate a broadcast domain at the Data Link Layer (L2)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
VLAN Hopping
Technique that exploits a misconfiguration to direct traffic to a different VLAN without proper Authorization
26
What techniques are used to accomplish VLAN hopping?
- Double Tagging - Switch Spoofing - MAC Table Overflow Attack
27
Double Tagging
Attacker tries to reach a different VLAN using Vulnerabilities in the trunk port configuration.
28
Switch Spoofing
Attackers attempts to use Dynamic Trunking Protocol (DTP) to negotiate a trunk port with a switch
29
MAC Table Overflow Attack
Allows VLANSs to no longer be enforced
30
What two 802.q tags are sent by an attacker in a Double Tagging attack?
Inner Tag - Contains True destination Outer tag - Contains Native VLAN
31
T/F Double tagged Frames represent a one-way trip
True, the destination does not double-tag returned data
32
Why would an attacker want to send double tagging data into a VLAN without receiving a response?
- To conduct a Blind Attack - As part of a DoS or Stress Testing Attack
33
Blind Attack
Commands are sent to the victim, but the attacker or pentester does not get to see any of the responses
34
How can you prevent a Double Tagging attack?
- Change default native VLAN ID - Avoid adding user devices to the native VLAN
35
How can you prevent Switch Spoofing?
Configure switches with Dynamic switch port modes disabled by default
36
What are some DNS attacks?
- DNS Cache Poisoning - DNS Amplification attacks - DNS Tunneling - Domain Hijacking - DNS Zone transfer attacks
37
DNS Cache Poisoning
Corrupting DNS resolver cache with false information to redirect traffic
38
DNS Amplification Attacks
Attacker exploits the DNS resolution process to overwhelm a target system with DNS response traffic
39
DNS Tunneling
Using DNS protocol to encapsulate non-DNS traffic to attempt to bypass the organization's firewall rules
40
Domain Hijacking
Changing the registration of a domain name without the permission of the original registrant
41
DNS Zone Transfer Attacks
Attacker tries to get a copy of the entire DNZ zone data by pretending to be an authorized system
42
Protect against DNS cache Poisoning
- Use (DNSSEC) - Implement secure network config & Firewalls
43
Protect against DNS Amplification
- Limit size of DNS responses
44
Protect against DNS Tunneling
- Regularly monitor DNS logs
45
Protect against Domain Hijacking
- Regular updates - Ensure account registration information is secure - Use Domain Registry lock services
46
On-path Attack
attacker positions themselves between two devices (often a user and a server) to intercept or modify communications between them
47
What are 2 types of On-Path attacks?
- Replay - Relay
48
Replay Attack (MITM)
Attacker Captures Valid data and repeats it either immediately or with a delay
49
What another name for an On path attack?
Man In The MIddle Attack (MITM)
50
Relay Attack (MITM)
Attacker is able to insert themselves between two hosts and become part of the conversation
51
SSL Stripping
Redirecting HTTPS requests to HTTP in an attempt to trick the encryption app
52
Downgrade Attack
Attacker attempts to have a client or server abandon its higher security mode in favor of a lower security mode
53
Rogue Devices
Unauthorized Device or Service on a corporate or private network that allows unauthorized individuals to connect to that network
54
What different forms do Rogue systems come in?
- Network Taps - Wireless Access Points (WAP) - Servers - Wired And Wireless Clients - Software - Virtual Machines - Smart Appliances
55
Network Tap
Physical Device attached to cabling to record packets passing over the network segment
56
What are ways to detect rogue devices?
- Visual Inspection - Monthly/ Quarterly Inventories - Network mapping & host discovery - Wireless Monitoring - Packet Sniffing and Traffic Flow - NAC and intrusion detection
57
Social Engineering
Attempt to manipulate users to reveal confidential information or perform actions that can compromise a system's security
58
What are some Social Engineering attacks?
- Phishing - Tailgating - Piggybacking - Shoulder Surfing - Eavesdropping - Dumpster Divng
59
Phishing
Sending an email in an attempt to get a user to click a link
60
Spear Phishing
Targeted Phishing
61
Whaling
Focused on key executives within an organization
62
Tailgating
Entering a secure portion of a building by following authorized personal without their knowledge or consent
63
Piggybacking
like tailgating but with the employee's knowledge or consent
64
Shoulder Surfing
Coming up behind an employee and trying to use direct observation to obtain information
65
Dumpster Diving
Scavenging for personal or confidential information
66
Malware
Malicious Software designed to infiltrate a computer system and do damage and/or extract sensitive data.
67
What are some types of Malware?
- Virus - Worm - Trojan - Ransomware - Spyware - Rootkit
68
Virus
Malicious code that is run on a machine without the user's knowledge and is triggered through user action
69
Worm
A piece of malicious software that can replicate itself without user interaction
70
Trojan
Malicious software disguised as legitimate software
71
Ransomware
Malware that restricts access to a victim's computer or their files until a ransom is payed.
72
Spyware
Information gathering malware, that captures user data without their consent
73
Rootkit
Malware designed to gain admin level control over a computer system or network device without detection
74
Remote Access Trojan (RAT)
Provides the attacker with remote control of a victim machine

CompTIA Network+(N10-009) (16 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions