Detailed Explanations for Questions 271-300
Q271. What is the purpose of a man-in-the-middle attack?
- A. Gaining access
- B. Maintaining access
- C. Hijacking a session ✓
- D. Covering tracks
Why C is correct: A Man-in-the-Middle (MitM) attack positions the attacker between two communicating parties. The primary goal is often to intercept, eavesdrop, or hijack an existing authenticated session to gain unauthorized access to data or services without needing to crack credentials.
Why others are incorrect:
- A: Gaining access is typically the result of an initial exploit (like SQL injection or buffer overflow), whereas MitM intercepts existing access.
- B: Maintaining access refers to persistence mechanisms (like backdoors or rootkits) after a compromise is established.
- D: Covering tracks involves deleting logs and hiding evidence, which happens after the attack activities.
Q272. What is the primary objective of a Man-in-the-Middle (MitM) attack?
- A. To crash the server
- B. To intercept and potentially alter communication between two parties ✓
- C. To physically steal the hardware
- D. To delete database records
Why B is correct: The core definition of a MitM attack is the interception of communication between two victims. The attacker can passively listen (eavesdrop) or actively modify the data being exchanged (alteration) without the victims knowing.
Why others are incorrect:
- A: Crashing the server is the goal of a Denial-of-Service (DoS) attack.
- C: Physical theft is a physical security breach, not a network-based MitM attack.
- D: Deleting records is an act of sabotage or data destruction, not the primary mechanism of MitM.
Q273. Which of the following must be conducted first in order to hijack a session?
- A. Track the session. ✓
- B. Desynchronize the session.
- C. Inject the adversary’s packet into the stream.
- D. Disrupt the stream first and then inject the adversary’s packet information.
Why A is correct: Before an attacker can hijack a session, they must first monitor (sniff) the traffic to understand the sequence numbers, acknowledgment numbers, and session state. Tracking the session provides the necessary data to craft valid packets for hijacking.
Why others are incorrect:
- B: Desynchronization is a technique used during the hijack to knock the legitimate user offline, not the first step.
- C: Packet injection happens after the attacker has tracked the session and knows the correct sequence numbers.
- D: Disruption is part of the hijacking process, but tracking must occur first to know what to disrupt and how to take over.
Q274. Which flag is used to forcibly terminate a partially open TCP connection?
- A. FIN
- B. RST ✓
- C. ACK
- D. SYN
Why B is correct: The RST (Reset) flag immediately terminates a TCP connection without the graceful handshake. It is used when a connection is invalid, unauthorized, or needs to be killed abruptly (as in session hijacking to remove the legitimate user).
Why others are incorrect:
- A: FIN (Finish) is used for a graceful termination where both sides agree to close the connection.
- C: ACK (Acknowledgment) confirms receipt of data but does not terminate connections.
- D: SYN (Synchronize) is used to initiate a new connection.
Q275. What is the process of falsifying data, such as changing a source IP address?
- A. Phishing
- B. Spoofing ✓
- C. Sniffing
- D. Scanning
Why B is correct: Spoofing involves creating packets with a false source address (IP spoofing), MAC address (MAC spoofing), or other identity information to hide the attacker’s identity or impersonate a trusted system.
Why others are incorrect:
- A: Phishing is a social engineering attack using deceptive emails/messages.
- C: Sniffing is the passive capture of network traffic, not the alteration of packet headers.
- D: Scanning is the active probing of a network to discover hosts and ports.
Q276. The act of falsifying data is also known as what?
- A. Boink
- B. Packet crafting
- C. Spoofing ✓
- D. Data diddling
Why C is correct: In the context of network attacks, falsifying packet headers (like Source IP) is called Spoofing.
Why others are incorrect:
- A: Boink is a specific type of DoS attack using oversized packets, not the general act of falsifying data.
- B: Packet crafting is the creation of custom packets, which can be used for spoofing, but “Spoofing” is the specific term for the falsification act.
- D: Data diddling refers to altering data before or during entry into a system (often insider threat), not network packet falsification.
Q277. Which of the following allows the adversary to jump from the web directory to another part of the file system?
- A. Directory traversal ✓
- B. Pivoting
- C. Directory hopping
- D. Directory shifting
Why A is correct: Directory Traversal (or Path Traversal) attacks use sequences like ../ to access files and directories outside the web server’s root folder, allowing access to system files (e.g., /etc/passwd).
Why others are incorrect:
- B: Pivoting refers to using a compromised host to attack other networks, not file system navigation.
- C & D: “Directory hopping” and “Directory shifting” are not standard security terms for this attack.
Q278. Which of the following allows the adversary to jump from the web directory to another part of the file system?
- A. Directory traversal ✓
- B. Pivoting
- C. Directory hopping
- D. Directory shifting
(Duplicate of Q277) Why A is correct: Directory Traversal exploits insufficient security validation of file paths to access unauthorized files.
Why others are incorrect:
- B, C, D: Same as Q277.
Q279. What type of attack is shown in the following image? (Intercepting traffic)
- A. Man-in-the-middle ✓
- B. DoS
- C. DDoS
- D. Spear phishing
Why A is correct: An image depicting traffic interception between two parties represents a Man-in-the-Middle (MitM) attack, where the attacker secretly relays and possibly alters the communication.
Why others are incorrect:
- B & C: DoS/DDoS images typically show flooding traffic from one or many sources to one victim, not interception.
- D: Spear phishing is represented by targeted emails, not network traffic interception diagrams.
Q280. What type of attack is the adversary conducting in the following diagram? (Spoofed IP Ping Broadcast)
- A. Smurf attack ✓
- B. Bluesnarfing
- C. Teardrop attack
- D. DoS attack
Why A is correct: A Smurf attack involves sending ICMP Echo Requests (Pings) to a broadcast address with a spoofed source IP (the victim). All hosts reply to the victim, flooding them.
Why others are incorrect:
- B: Bluesnarfing is a Bluetooth attack.
- C: Teardrop involves fragmented packets overlapping to crash a system.
- D: While it is a DoS, “Smurf attack” is the specific and correct classification.
Q281. What type of attack is being conducted? (DDoS Image)
- A. Fraggle
- B. DDoS ✓
- C. DoS
- D. Bot attack
Why B is correct: An image showing multiple systems (zombies/bots) attacking a single target represents a Distributed Denial-of-Service (DDoS) attack.
Why others are incorrect:
- A: Fraggle is a specific type of DDoS using UDP, but the general diagram implies DDoS.
- C: DoS implies a single source; DDoS implies multiple distributed sources.
- D: “Bot attack” is a vague term; DDoS is the standard classification.
Q282. What is missing to complete the three-way handshake shown here?
- A. ACK/SYN
- B. ACK
- C. TCP/IP
- D. SYN/ACK ✓
Why D is correct: In the TCP three-way handshake, after the client sends SYN, the server responds with SYN/ACK. If the diagram shows the first step (SYN), the missing second step is SYN/ACK.
Why others are incorrect:
- A: ACK/SYN is the wrong order; the standard is SYN/ACK.
- B: ACK is the third and final step.
- C: TCP/IP is the protocol suite, not a handshake packet.
Q283. What would be the last values to complete the connection? (TCP Handshake Scenario)
- A. SEQ: 302 ACK: 200 FLAGS: SYN
- B. SEQ: 302 ACK: 201 FLAGS: ACK
- C. SEQ: 301 ACK: 202 FLAGS: ACK
- D. SEQ: 301 ACK: 244 FLAGS: ACK ✓
Why D is correct: In TCP, the ACK number is always the received Sequence Number + 1. Based on the specific scenario math provided in the source context (likely Server SEQ was 243), the Client ACKs with 244. The Flag must be ACK to complete the handshake.
Why others are incorrect:
- A: FLAGS: SYN is for initiation, not completion.
- B & C: The ACK numbers do not match the expected sequence math for this specific scenario.
Q284. In the TCP three-way handshake, which is next after the initial SYN packet is sent?
- A. An ACK is received.
- B. A SYN is received.
- C. A SYN/ACK is sent. ✓
- D. An ACK is sent.
Why C is correct: Step 1: Client sends SYN. Step 2: Server sends SYN/ACK. Therefore, after the initial SYN, the next event is the transmission of SYN/ACK by the server.
Why others are incorrect:
- A & D: A pure ACK is Step 3 (from Client).
- B: The server sends a SYN combined with an ACK, not just a SYN.
Q285. What completes the three-way handshake in the TCP connection?
- A. RST
- B. SYN/ACK
- C. ACK ✓
- D. FIN
Why C is correct: The third and final step of the TCP handshake is the client sending an ACK packet to the server’s SYN/ACK, establishing the connection.
Why others are incorrect:
- A: RST terminates a connection.
- B: SYN/ACK is the second step.
- D: FIN terminates a connection gracefully.
Q286. Which is the last step in the TCP three-way handshake?
- A. ACK ✓
- B. SYN
- C. SYN/ACK
- D. FIN
Why A is correct: The sequence is SYN → SYN/ACK → ACK. The ACK is the final step.
Why others are incorrect:
- B: SYN is the first step.
- C: SYN/ACK is the second step.
- D: FIN is for connection termination, not establishment.
Q287. What steps does the TCP handshake follow as described by the flags that are set?
- A. FIN, ACK, FIN
- B. SYN, SYN, ACK
- C. SYN, ACK, FIN
- D. SYN, SYN/ACK, ACK ✓
Why D is correct: This accurately describes the flag sequence: Client SYN, Server SYN+ACK, Client ACK.
Why others are incorrect:
- A: Describes a termination sequence (and incorrectly).
- B: Missing the ACK flag in the second step.
- C: Mixes establishment and termination flags.
Q288. What flag is used to order a connection to terminate?
- A. SYN
- B. FIN ✓
- C. PSH
- D. RST
Why B is correct: The FIN (Finish) flag indicates that the sender has no more data to transmit and wishes to close the connection gracefully.
Why others are incorrect:
- A: SYN initiates connections.
- C: PSH (Push) forces immediate data delivery.
- D: RST aborts the connection immediately (not a graceful order to terminate).
Q289. Which flag is used to terminate a connection that is only partially open?
- A. FIN
- B. RST ✓
- C. URG
- D. SYN
Why B is correct: If a connection is half-open or invalid, the RST (Reset) flag is used to immediately tear it down without the four-way termination handshake required by FIN.
Why others are incorrect:
- A: FIN is for established connections undergoing graceful close.
- C: URG indicates urgent data.
- D: SYN starts connections.
Q290. What UDP flag forces a connection to terminate at both ends of the circuit?
- A. RST
- B. FIN
- C. None ✓
- D. URG and RST
Why C is correct: UDP is a connectionless protocol. It does not establish connections, nor does it have flags (like SYN, FIN, RST) to terminate them.
Why others are incorrect:
- A, B, D: These are TCP flags. UDP headers only contain Source Port, Destination Port, Length, and Checksum.
Q291. Which flags would create a half-open connection if they are not responded to?
- A. FIN
- B. SYN ✓
- C. SYN/ACK
- D. URG
Why B is correct: A SYN flood attack works by sending SYN packets and never completing the handshake (never sending the final ACK). This leaves the server with many “half-open” connections consuming resources.
Why others are incorrect:
- A: FIN closes connections.
- C: SYN/ACK is a response from the server.
- D: URG handles priority data.
Q292. Which of the following has no flags set and does not respond if a port is open?
- A. XMAS scan
- B. NULL scan ✓
- C. Half-open connection
- D. ACK scan
Why B is correct: A NULL scan sends a TCP packet with no flags set. According to RFC 793, if a port is open, there is no response. If closed, the target sends a RST.
Why others are incorrect:
- A: XMAS scan has FIN, PSH, and URG flags set.
- C: Half-open refers to SYN scans (SYN flag set).
- D: ACK scan has the ACK flag set.
Q293. Which of the following has no flags set and does not respond if a port is open?
- A. XMAS scan
- B. NULL scan ✓
- C. Half-open connection
- D. ACK scan
(Duplicate of Q292) Why B is correct: NULL scans send packets with a flag value of 0. Open ports drop them silently.
Why others are incorrect:
- A, C, D: All involve setting specific flags (FIN/PSH/URG, SYN, or ACK).
Q294. What flag(s) is(are) set in the following screen shot? (ACK, FIN)
- A. FIN
- B. ACK, FIN ✓
- C. ACK
- D. None
Why B is correct: Based on the screenshot data provided in the exam context, both the ACK and FIN bits are marked as 1 (set). This combination is typical when a party wants to acknowledge data and close the connection simultaneously.
Why others are incorrect:
- A & C: Only identify one of the two flags set.
- D: Incorrect as flags are clearly set.
Q295. In the following screen shot, what flag is set on frame 57523? (0x02)
- A. 0x02 ✓
- B. 0x00
- C. 0x01
- D. 0x20
Why A is correct: The question asks for the value shown in the screenshot for the flags field. In TCP, 0x02 typically represents the SYN flag. The answer matches the hex value displayed in the analysis tool.
Why others are incorrect:
- B: 0x00 would mean no flags (NULL scan).
- C: 0x01 typically represents the FIN flag.
- D: 0x20 typically represents the URG flag.
Q296. In the following screenshot, why is the packet flag set to “Don’t Fragment”?
- A. The client is trying to establish a TCP handshake.
- B. A Hello Server packet has been crafted.
- C. The packet does not need to be fragmented.
- D. The client is trying to establish an SSL connection. ✓
Why D is correct: During SSL/TLS handshakes, the “Don’t Fragment” (DF) flag is often set to ensure security parameters and certificates are not fragmented, which could complicate the secure handshake or be exploited.
Why others are incorrect:
- A: Standard TCP handshakes do not strictly require the DF flag.
- B: “Hello Server” is part of SSL, but the specific reason for DF is the secure connection establishment.
- C: While true that it doesn’t need fragmentation, the reason for setting the flag is the protocol requirement for SSL.
Q297. In the following screen shot, why is the packet flag set to “Don’t Fragment”?
- A. The client is trying to establish a TCP handshake.
- B. A Hello Server packet has been crafted.
- C. The packet does not need to be fragmented.
- D. The client is trying to establish an SSL connection. ✓
(Duplicate of Q296) Why D is correct: Setting the DF flag is common practice during SSL/TLS negotiations to prevent fragmentation of critical handshake messages.
Why others are incorrect:
- A, B, C: Same reasoning as Q296.
Q298. What is the result of conducting a MAC flood on a switch?
- A. The switch would fail to respond.
- B. It would create a DoS.
- C. The switch would operate as if it were a hub. ✓
- D. The switch would continue to operate as normal.
Why C is correct: MAC flooding fills the switch’s CAM (Content Addressable Memory) table. When full, many switches fail “open,” broadcasting all traffic to all ports like a hub, allowing the attacker to sniff traffic.
Why others are incorrect:
- A: The switch usually continues to function but in a degraded, insecure mode.
- B: While it can cause a DoS, the primary security result for the attacker is the hub-like behavior enabling sniffing.
- D: Normal operation (isolating traffic) is exactly what is lost.
Q299. When a layer 2 switch is flooded, what mode does it default to?
- A. Fail open mode, where it mimics a hub. ✓
- B. Fail closed, where nothing is passed anymore.
- C. Layer 2 switches process IP packets and not datagrams.
- D. Layer 2 switches cannot be flooded because they are collision domains.
Why A is correct: “Fail open” means the switch defaults to broadcasting traffic to ensure connectivity when it can’t track MAC addresses, effectively acting like a hub.
Why others are incorrect:
- B: “Fail closed” would stop all traffic, which is not the typical default behavior for CAM table overflow.
- C: Layer 2 switches process Frames (MAC addresses), not IP packets (Layer 3).
- D: Switches create collision domains per port, but they can definitely be flooded.
