Samantha was hired to perform an internal security test of XYZ. She quickly realized that all
networks are making use of switches instead of traditional hubs. This greatly limits her ability to
gather information through network sniffing.
Which of the following techniques can she use to gather information from the switched network or
to disable some of the traffic isolation features of the switch? (Choose two)
A.
Ethernet Zapping
B.
MAC Flooding
C.
Sniffing in promiscuous mode
D.
ARP Spoofing
Explanation:
In a typical MAC flooding attack,a switch is flooded with packets,each containing
different source MAC addresses. The intention is to consume the limited memory set aside in the
switch to store the MAC address-to-physical port translation table.The result of this attack causes
the switch to enter a state called failopen mode,in which all incoming packets are broadcast out on
all ports (as with a hub),instead of just down the correct port as per normal operation. The principle
of ARP spoofing is to send fake,or ‘spoofed’,ARP messages to an Ethernet LAN. These frames
contain false MAC addresses,confusing network devices,such as network switches. As a result
frames intended for one machine can be mistakenly sent to another (allowing the packets to be
sniffed) or an unreachable host (a denial of service attack).
A comment on explanation:
Maybe I didn’t understand the explanation correctly, but as far as I know, switches does not work on IP layer (except L3 switches, but they are basically limited routers).
ARP is L2 protocol which makes mapping IP addresses to MAC addresses in L3 devices (routers and hosts), and because of IP addresses (L3), ARP poisoning will not directly influence on switches in a network. Switches do not see the IP layer (L3) of OSI model. But ARP poisoning will confuse routers and hosts.
The rest of explanation looks fine to me.
b and c