CCNA Network Attacks And Defense Strategies Questions

An SBOM inventories every third-party component, while automated SCA continuously detects known vulnerabilities in those dependencies, directly countering supply chain attacks. This satisfies the stem's requirement to harden against compromised third-party software dependencies and vendor integrations.

IMDSv2 mitigates SSRF by requiring a PUT request to obtain a session token before any metadata query, which attacker-controlled URL parameters cannot supply. Combined with strict URL parsing libraries that reject malformed or redirecting inputs, this directly satisfies the stem's constraint: preventing SSRF exploitation against the instance metadata service.

A SYN proxy on the firewall completes the TCP three-way handshake on behalf of the protected server, only forwarding connections that successfully finish the handshake, which defeats spoofed-source SYN floods. Combined with per-source rate limiting, legitimate clients still connect while randomized-source floods are absorbed at the perimeter, matching the requirement to mitigate at the network edge.

A WAF terminates HTTP traffic and inspects parameters, headers and bodies against signature rule sets, matching union-based SQLi patterns. Anomaly scoring aggregates suspicious attributes, letting it block malicious requests before they reach the application, satisfying the requirement for dynamic inspection of HTTP parameters.

An NGFW with Deep Packet Inspection and App-ID identifies applications regardless of port, so exfiltration over TCP 4443 to an unknown host is recognised and blocked. Port-based filtering alone would miss this, since the traffic uses a non-standard port.

DNS tunneling encodes payload data into query names, producing unusually long labels, high character entropy, and a flood of unique subdomains under one parent domain. These are observable in resolver logs and passive DNS metadata without any decryption, making them the most reliable indicator. Baseline deviation on query length, entropy, and volume per domain exposes the tunnel even when the encoded content itself is unreadable.

Mandatory Protected Management Frames cryptographically authenticate unicast and broadcast management frames, blocking forged deauthentication and disassociation frames that attackers use to force client disconnections and capture handshakes. This directly satisfies the stem's requirement for advanced hardening against sophisticated wireless attacks, closing a gap that WPA2 alone leaves open.

Amazon S3 Block Public Access applies account-level and bucket-level controls that override bucket policies and ACLs, preventing public exposure at the source rather than merely detecting it afterwards. This satisfies the stem's requirement for an automated preventive control across all AWS accounts, blocking misconfigured public access before it occurs.

MAC flooding exhausts the finite CAM table, forcing the switch to behave like a hub and flood unicast frames to all ports, enabling passive capture. Port security limits the number of source MAC addresses learned per interface and can restrict, protect, or shut down the port on violation, directly restoring the integrity of the forwarding table and preventing the overflow condition.

Rogue AP Detection with Automated Containment lets the WLC classify access points by comparing their wired MAC addresses against the known authorised list, then issue 802.11 deauthentication frames to clients associated with the offending BSSID. This directly satisfies the stem's requirement to automatically detect and contain the evil twin without manual intervention.

Severing network connectivity halts lateral spread and blocks command-and-control or encryption traffic to still-connected shares. Disconnecting physical links or triggering EDR network containment satisfies the stem's immediate containment requirement, isolating compromised endpoints before eradication and recovery proceed.

XSS attacks embed client-side script in request parameters, which browsers later execute. WAF rules inspect parameter values for injected script tags and block matching requests, satisfying the requirement to detect and block common web attacks.

A suppress rule in snort.conf tells Snort to stop generating alerts for a specific signature ID, optionally scoped to a target IP, satisfying the stem's need to silence this false-positive signature. It disables alerting without deleting the rule, preserving detection elsewhere.

The find command with -perm /4000 recursively scans the filesystem for regular files carrying the SUID bit, and 2>/dev/null suppresses permission errors. This enumerates every SUID binary so the engineer can identify and remove unauthorised ones, directly addressing the privilege escalation vector.

Fixed-interval callbacks with slight payload variation indicate beacon jitter designed to frustrate pattern-based detection, while a self-signed certificate on port 443 signals a non-standard TLS implementation rather than a real web service. The rotating destination list is a fallback mechanism so the implant survives takedowns of individual C2 nodes, all of which is characteristic of custom command-and-control beaconing.

Anonymous LDAP binds let the workstation enumerate users and groups without credentials. Enforcing LDAP signing and channel binding via Group Policy authenticates and integrity-protects the session, while disabling anonymous enumeration removes the unauthenticated query path the SIEM detected.

PsExec moves laterally over SMB TCP 445 and RPC, so restricting inbound access on those ports to authorised jump hosts blocks the technique domain-wide. WDAC adds application control, preventing execution of the PsExec binary on non-administrative endpoints.

Behavioural anomaly detection plus EDR identifies malicious activity on internal endpoints by monitoring process behaviour rather than static signatures, enabling rapid detection and response. This satisfies the adaptive strategy's requirement for continuous monitoring within trusted internal zones.

The `dsize:>1000` option matches packets whose payload exceeds 1000 bytes, directly satisfying the stem's covert-channel detection constraint. The `icmp` protocol keyword restricts inspection to ICMP traffic, so oversized echo requests carrying tunnelled data trigger the alert while normal pings pass uninspected.

Dynamic ARP Inspection validates ARP packets against the DHCP snooping binding table, dropping replies with spoofed IP-to-MAC mappings. This directly neutralises ARP cache poisoning on the subnet, satisfying the requirement to stop the MitM attack at the switch rather than relying on host-based detection.

An SPF TXT record lists the IP addresses and hosts authorised to send mail for the domain. Receiving servers check the envelope sender against this record, so unauthorised senders fail the check and spoofed messages are rejected.

Load balancers and reverse proxies terminate connections and can enforce per-source rate limits, concurrent connection caps, and request thresholds, absorbing application-layer and some volumetric bursts that reach the edge. Combined with health checks and SYN cookie protections, these controls keep backend servers responsive during a flood by shedding abusive sessions while allowing normal clients through.

fail2ban tails authentication logs, matches repeated failure patterns against configured filters, and inserts temporary iptables drop rules for offending source addresses. This satisfies the requirement for automatic log inspection coupled with dynamic firewall blocking, without manual intervention during the ongoing brute-force attack.

Domain fronting exploits CDN SNI/Host header separation: the TLS SNI shows a benign CDN domain while the inner HTTP Host header routes to the attacker's backend. This satisfies the requirement to obfuscate C2 through legitimate network services, since traffic appears destined for a trusted CDN.

Algorithm confusion attacks succeed because the validator trusts the token's alg header. Enforcing an explicit allowlist such as RS256 and rejecting 'none' ensures the signature is always verified with the expected algorithm, closing the bypass.

SSL/TLS decryption on the NGFW or Secure Web Gateway terminates outbound TLS, inspects the plaintext for C2 payloads, then re-encrypts. This satisfies the requirement to detect malicious HTTPS beaconing content while enforcing compliance controls over what is inspected and logged.

DNS tunnelling encodes stolen data or C2 instructions inside DNS query names, so filtering 'dns' and examining query strings for abnormal length, high entropy, or encoded patterns exposes the exfiltration channel that normal DNS traffic would not exhibit.

Management APIs exposed without authentication, rate limiting or input validation let attackers enumerate resources, brute-force credentials or inject commands, directly reaching cloud control planes. This satisfies the stem's requirement for a primary cloud breach vector arising from misconfiguration.

HttpOnly blocks JavaScript access to the cookie, defeating document.cookie theft during XSS execution. Secure ensures the cookie transmits only over HTTPS, preventing interception through network sniffing. Together they satisfy both stated attack vectors, whereas either flag alone leaves one exposure unaddressed.

Credential Guard uses Virtualization-based Security to isolate NTLM password hashes and derived credentials in a separate virtualised process, so harvested hashes cannot be replayed for authentication. This directly neutralises pass-the-hash lateral movement at the host level.

DCSync abuses the directory replication protocol by impersonating a domain controller. Granting 'Replicating Directory Changes' and 'Replicating Directory Changes All' on the domain object lets a principal request password hashes via DRSUAPI. Auditing and restricting these rights removes the non-administrative path to credential material.

An evil twin is a rogue access point that clones the SSID and, often, the BSSID of a legitimate network while offering a stronger signal to entice automatic client association. Once users connect, the attacker controls all traffic and can present a counterfeit captive portal to harvest credentials. This matches the scenario exactly, including the stronger signal and the fake portal used for credential capture.

Dynamic ARP Inspection validates ARP packets against the DHCP snooping binding table, dropping those with mismatched MAC-to-IP mappings. This directly satisfies the stem's Layer 2 hardening requirement by preventing ARP spoofing and man-in-the-middle attacks on access and distribution switches, where untrusted hosts could otherwise poison gateway caches.

DHCP snooping filters DHCP messages on untrusted ports, dropping rogue OFFERs and ACKs from unauthorised servers while rate-limiting DISCOVER floods. Marking user access ports untrusted satisfies the constraint of blocking both spoofed servers and starvation attacks at the access layer.

Cron tables and spool directories hold scheduled task definitions per user and system-wide. Attackers persist by inserting entries that re-execute payloads after reboot, so inspecting /etc/crontab and /var/spool/cron reveals unauthorised jobs, directly satisfying the persistence mechanism requirement in the stem.

SELinux and AppArmor are Linux Security Modules built into the kernel that enforce mandatory access control, confining each process to a defined policy regardless of user privileges. Running in enforcing mode blocks any access outside that policy, satisfying the requirement to restrict processes to only necessary resources.

DKIM adds a cryptographic signature to outbound mail headers, letting receivers verify the message was authorised by the sending domain and was not altered in transit. This directly counters spoofing and tampering, satisfying the requirement to enforce authentication records against phishing and credential harvesting.