CCNA Networking and Protocols Questions

DHCP Snooping tracks legitimate IP-to-MAC address assignments by monitoring untrusted switch ports. Dynamic ARP Inspection references this verified database to intercept and drop malicious ARP packets, successfully preventing both DHCP spoofing and man-in-the-middle ARP cache poisoning attempts.क्क

MAC flooding sends frames with many spoofed source MAC addresses, exhausting the switch's CAM table. Once the table is full, the switch cannot map destinations to ports and falls back to flooding unknown unicast frames out every port, allowing the attacker to capture traffic intended for other hosts. The log pattern of many MACs learned on one port is the direct signature of this technique.

Path MTU discovery depends on ICMP Destination Unreachable with the fragmentation-needed code to tell the sender to reduce packet size. If that ICMP is filtered, the sender never learns the smaller MTU and keeps emitting oversized packets that are silently dropped. This exactly produces the pattern where small packets pass and large ones fail, making it a genuine cause in this scenario.

A Switched Port Analyzer (SPAN) session copies frames from selected source ports or VLANs to a destination port, allowing the sensor to passively observe unicast traffic it would otherwise never receive. This is the standard, vendor-supported way to gain visibility on a switched segment without disrupting forwarding, and it satisfies the requirement that the sensor see traffic not addressed to it.

Microsegmentation applies granular security policy to individual workloads or groups, often using an overlay that decouples policy from physical topology. Because enforcement is tied to workload identity and tags rather than subnet boundaries, an attacker who compromises one workload cannot freely reach others. This directly satisfies the requirement to restrict lateral movement and enforce identity-based policy, making it a correct choice for the scenario.

Dynamic ARP Inspection intercepts ARP packets on untrusted ports and compares the sender IP and MAC against the DHCP snooping binding database. A forged reply from a MAC that does not own the gateway address is dropped before it reaches the workstation, so the victim never updates its ARP cache with the attacker's address. This directly targets the gratuitous or unsolicited ARP reply used in the on-path attack.

nslookup queries DNS servers directly and reports the resolved address or an error, which quickly confirms whether the configured resolver can resolve the internal hostname. Because the application works by IP, the failure is isolated to name resolution, and this command tests exactly that path. It is available on Windows, Linux, and macOS and is the appropriate first diagnostic step in this scenario.

ARP cache poisoning involves sending forged ARP replies to associate an attacker's MAC address with a legitimate IP, such as the default gateway. This allows the attacker to intercept or redirect traffic. In this scenario, the unsolicited replies with a mismatched MAC for the gateway IP are a classic indicator of ARP spoofing, enabling man-in-the-middle or denial-of-service conditions on the LAN.

DNS tunneling encodes arbitrary payloads into query names and response records, using the resolver as a transport to an attacker-controlled authoritative server. Long, high-entropy subdomain labels and a high volume of queries to one domain are classic indicators. Because DNS is rarely blocked, this technique lets a compromised host exfiltrate data and receive commands while blending into normal resolution traffic.

A TLS-based portal authenticates the server with a certificate the client validates, and multi-factor authentication protects against stolen passwords. HSTS forces browsers to use HTTPS and prevents downgrade or SSL-stripping attacks. Because the client only needs to trust the server certificate and complete MFA, no client certificate is required on the personal device, satisfying all stated constraints.

During the TLS handshake the server transmits its X.509 certificate, and the client verifies the signature chain up to a trusted root, checks the subject name against the requested host, and confirms validity dates. Only after this validation does the client derive session keys and send the HTTP request. This is precisely the mechanism that authenticates the server's identity before application data flows on port 443.

IPsec offers a suite of protocols that provide encryption, integrity, and authentication at the network layer. By securing packets between two hosts, it ensures that even if internal traffic is intercepted, the payload remains unreadable and protected from tampering, which is necessary for sensitive data transmission.

ICMP Timestamp replies expose a device's current clock and uptime, letting an attacker fingerprint the OS, infer patch cycles, and correlate hosts across the estate. On perimeter routers this reconnaissance data aids targeted exploitation, which is the specific risk the question asks about.

TCP half-open scanning, often called SYN scanning, involves sending SYN packets to probe ports. The attacker analyzes the responses to determine if ports are open, closed, or filtered. Because the full handshake is never completed, the scanning activity is harder to log on the target system.

UDP eliminates the overhead of the three-way handshake required by TCP. By sending data immediately without establishing a stateful connection, UDP significantly reduces latency, which is essential for time-sensitive applications like DNS queries, streaming media, and VoIP, where retransmission delays would degrade the user experience.

Malicious actors encode stolen data or remote commands within the subdomains of DNS requests or inside TXT records. Inspecting query frequency, length, and entropy reveals the high-density encoded payloads characteristic of modern tunneling tools like Iodine.क्क

DHCP uses UDP because the client initially has no IP address and must broadcast. The server listens on UDP port 67 and the client uses UDP port 68. The four-step DORA exchange (Discover, Offer, Request, Acknowledge) fits this model. This combination correctly matches both the transport protocol and the port assignments observed in the scenario.

Egress filtering inspects and blocks outbound traffic at router and firewall interfaces, permitting only approved ports and protocols. This directly prevents the unexpected outbound administrative channels observed, satisfying the requirement to restrict unauthorised outbound communication at the network perimeter.