Detailed Explanations for Questions 201-225
Q201. Why would an attacker want to avoid tapping into a fiber-optic line?
- A. It costs a lot of money to tap into a fiber line.
- B. If done wrong, it could cause the entire connection signal to drop, therefore bringing unwanted attention from the targeted organization. ✓
- C. The network traffic would slow down significantly.
- D. Tapping the line could alert an IPS/IDS.
Why B is correct: Fiber-optic tapping requires physically accessing the cable and bending it to leak light signals to a receiver. This process is delicate; if the bend radius is too tight or the tap is poorly installed, it causes significant signal attenuation or complete connection failure. This downtime triggers network management alarms, alerting administrators to a physical breach.
Why others are incorrect:
- A: While equipment can be expensive, the operational risk of detection due to signal loss is the primary deterrent for attackers.
- C: A proper tap shouldn’t slow traffic; the risk is signal loss, not latency.
- D: IPS/IDS monitors network traffic content, not physical layer signal integrity; physical taps are detected via network management systems monitoring light levels.
Q202. Which packet sniffing tool allows you to specify the individual fields you want printed in the output?
- A. Nmap
- B. tshark ✓
- C. tcpdump
- D. Snoop
Why B is correct: tshark is the command-line interface for Wireshark. It allows users to apply Wireshark display filters and specify exactly which packet fields (e.g., ip.src, tcp.port) should be printed in the output using the -T fields and -e options.
Why others are incorrect:
- A: Nmap is a port scanner and network discovery tool, not a packet sniffer for field extraction.
- C:
tcpdumpcaptures and prints packets, but lacks the granular field-specific output customization oftshark. - D: Snoop is a legacy Solaris packet sniffer with less flexibility compared to modern tools like
tshark.
Q203. What is the result of conducting a MAC flood on a switch?
- A. The switch would fail to respond.
- B. It would create a DoS.
- C. The switch would operate as if it were a hub. ✓
- D. The switch would continue to operate as normal.
Why C is correct: MAC flooding overwhelms the switch’s Content-Addressable Memory (CAM) table with fake MAC addresses. When the table fills, many switches enter a “fail-open” state, broadcasting all incoming traffic to all ports (like a hub) to ensure delivery, allowing the attacker to sniff traffic intended for other hosts.
Why others are incorrect:
- A: Switches typically don’t stop responding entirely; they degrade to hub-like behavior.
- B: While it can cause performance issues, the primary result for an attacker is the ability to sniff traffic, not necessarily a full Denial of Service.
- D: Normal operation (isolating traffic to specific ports) is what the attacker aims to disrupt.
Q204. Which of the following is the correct way to search for a specific IP address in Wireshark using a display filter?
- A. ip.addr= 192.168.1.100
- B. ip== 192.168.1.100
- C. ip= 192.168.1.199
- D. ip.addr== 192.168.1.100 ✓
Why D is correct: Wireshark display filters use the syntax field.operator.value. The field for IP address is ip.addr, the comparison operator is == (equals), and the value is the IP. This filters for packets where the IP address is either the source or destination.
Why others are incorrect:
- A: Uses a single
=which is invalid for comparison in Wireshark filters (used for assignment in programming). - B:
ipis a protocol, not a specific field;ip.addris required. - C: Uses a single
=and the IP address differs from the question context (though syntax is the main error).
Q205. To sniff, what mode must your network adapter be configured to to pull frames off an Ethernet or wireless network that aren’t addressed to you?
- A. Active
- B. Promiscuous ✓
- C. Stealth
- D. CSMA/CD mode
Why B is correct: Promiscuous mode disables the NIC’s hardware filter that normally discards frames not addressed to its MAC address (or broadcast/multicast). This allows the adapter to pass all traffic on the wire to the CPU for analysis.
Why others are incorrect:
- A: Active is not a standard NIC configuration mode for sniffing.
- C: Stealth is not a NIC mode; it refers to evasion techniques.
- D: CSMA/CD (Carrier Sense Multiple Access with Collision Detection) is a media access control method for Ethernet, not a NIC sniffing mode.
Q206. To capture all traffic to/from a specific workstation on a Cisco switch, which port configuration should you implement?
- A. SPAN port ✓
- B. SPAM port
- C. Trunk port
- D. STP port
Why A is correct: SPAN (Switched Port Analyzer), also known as port mirroring, copies traffic from a source port (the workstation) to a destination port (where the sniffer is connected), allowing monitoring of specific traffic on a switched network.
Why others are incorrect:
- B: SPAM port is not a real networking term.
- C: Trunk ports carry traffic for multiple VLANs between switches, not specifically for mirroring a single workstation’s traffic.
- D: STP (Spanning Tree Protocol) is used to prevent switching loops, not for traffic capture.
Q207. What is a content-addressable memory table?
- A. A table of IP addresses
- B. A table used to view NetBIOS names
- C. A table of MAC addresses associated with ports ✓
- D. A list of domain names tied to IP addresses
Why C is correct: The CAM table is used by Layer 2 switches to map MAC addresses to specific physical switch ports. This allows the switch to forward frames only to the intended destination port rather than broadcasting.
Why others are incorrect:
- A: ARP tables map IP addresses to MAC addresses.
- B: NetBIOS names are resolved via WINS or broadcast, not stored in the switch CAM table.
- D: DNS tables/cache map domain names to IP addresses.
Q208. When a layer 2 switch is flooded, what mode does it default to?
- A. Fail open mode, where it mimics a hub. ✓
- B. Fail closed, where nothing is passed anymore.
- C. Layer 2 switches process IP packets and not datagrams.
- D. Layer 2 switches cannot be flooded because they are collision domains.
Why A is correct: When the CAM table overflows due to flooding, many switches default to “fail-open” behavior, broadcasting traffic to all ports to prevent data loss, effectively acting like a hub.
Why others are incorrect:
- B: Fail closed would stop all traffic, which is not the typical default behavior for CAM table exhaustion.
- C: Layer 2 switches process frames (MAC addresses), not IP packets (Layer 3).
- D: Switches create collision domains per port, but they can still be flooded (MAC flooding).
Q209. What mode on a network interface is necessary to capture traffic?
- A. Promiscuous mode ✓
- B. Monitor mode
- C. Capture mode
- D. Interface mode
Why A is correct: For wired Ethernet networks, Promiscuous mode is required to capture all traffic on the segment, not just traffic addressed to the local machine.
Why others are incorrect:
- B: Monitor mode is specific to wireless interfaces (802.11).
- C: Capture mode is not a standard NIC setting name.
- D: Interface mode is too generic and not a specific configuration for sniffing.
Q210. What do you need to enable on a network interface that allows you to see the radio headers in the communication?
- A. Promiscuous mode
- B. Radio mode
- C. Monitor mode ✓
- D. Capture mode
Why C is correct: Monitor mode is specific to wireless adapters. It allows the card to capture all 802.11 frames, including management and control frames (radio headers), without associating with an access point.
Why others are incorrect:
- A: Promiscuous mode on wireless often still filters out frames not associated with the connected BSSID; Monitor mode is needed for full radio header visibility.
- B: Radio mode is not a standard configuration setting.
- D: Capture mode is not a standard configuration setting.
Q211. To sniff wireless traffic at layer 2, what must you have set on your wireless adapter?
- A. Transport mode
- B. Promiscuous mode
- C. Transparency mode
- D. Monitor mode ✓
Why D is correct: Monitor mode allows a wireless NIC to capture all packets in the air on a specific channel, including those not destined for the adapter, which is essential for Layer 2 wireless sniffing.
Why others are incorrect:
- A: Transport mode is an IPSec configuration, not a wireless adapter setting.
- B: Promiscuous mode is for wired Ethernet; wireless requires Monitor mode to see all frames.
- C: Transparency mode is not a standard wireless adapter setting.
Q212. What must a user have to sniff the full stack of wireless traffic?
- A. Wireless device set to promiscuous mode
- B. Wireless device that has 2.4 GHz and 5 GHz set to read only
- C. Wireless device set to monitor mode ✓
- D. Ettercap set to clone
Why C is correct: To capture the full stack of wireless traffic (including management frames and packets for other clients), the wireless adapter must be in Monitor mode.
Why others are incorrect:
- A: Promiscuous mode is insufficient for wireless; it typically only captures data frames associated with the connected AP.
- B: Frequency settings do not enable packet capture capabilities.
- D: Ettercap is a software tool for MITM attacks, not a hardware configuration for the adapter.
Q213. Which of the following applications is used to inspect packets?
- A. Wireshark ✓
- B. Cain & Abel
- C. Aircrack
- D. Nmap
Why A is correct: Wireshark is the industry-standard protocol analyzer used to capture and interactively browse the traffic running on a computer network (packet inspection).
Why others are incorrect:
- B: Cain & Abel is primarily for password recovery and ARP spoofing.
- C: Aircrack-ng is a suite for assessing WiFi network security (cracking keys).
- D: Nmap is a network scanner for host discovery and security auditing.
Q214. Which of the following tools allows some users to monitor all network activity?
- A. Nmap
- B. Metasploit
- C. Wireshark ✓
- D. Netcraft
Why C is correct: Wireshark allows users to capture and monitor network traffic in real-time, providing visibility into all activity passing through the network interface.
Why others are incorrect:
- A: Nmap scans for hosts and services; it doesn’t monitor ongoing traffic.
- B: Metasploit is an exploitation framework.
- D: Netcraft is a web server survey and security testing service.
Q215. What tool could you use to assist in capturing radio headers on wireless networks?
- A. Nmap
- B. Ettercap
- C. Airmon-ng ✓
- D. Ophcrack
Why C is correct: airmon-ng is part of the Aircrack-ng suite and is used to enable monitor mode on wireless interfaces, which is necessary for capturing radio headers.
Why others are incorrect:
- A: Nmap is for scanning, not configuring wireless adapter modes.
- B: Ettercap is for MITM attacks on switched networks.
- D: Ophcrack is a password cracker using rainbow tables.
Q216. Which of the following tools can be used to steal cookies between a client and a server to use in a replay attack?
- A. Mouse
- B. Ferret ✓
- C. Ratpack
- D. Nezumi
Why B is correct: Ferret (often used with Hamster) is a tool specifically designed for session hijacking by sniffing and stealing cookies from unencrypted traffic for replay attacks.
Why others are incorrect:
- A: A mouse is a hardware input device.
- C: Ratpack is not a standard security tool for this purpose.
- D: Nezumi is not a standard security tool for this purpose.
Q217. What would you use the program packETH for?
- A. Packet crafting ✓
- B. Ethernet testing
- C. Man-in-the-middle attack
- D. IP analysis
Why A is correct: packETH is a packet generator and analyzer tool that allows users to create and send arbitrary Ethernet packets (packet crafting) for testing and analysis.
Why others are incorrect:
- B: While it tests Ethernet, its primary function is crafting specific packets.
- C: It can be used in a MITM attack, but its core function is crafting.
- D: It generates packets rather than analyzing existing IP traffic like Wireshark.
Q218. What utility will display active network connections on a host?
- A. Netcat
- B. netstat ✓
- C. Nmap
- D. Ns
Why B is correct: netstat (network statistics) is a command-line tool that displays active TCP connections, listening ports, and network statistics on the local host.
Why others are incorrect:
- A: Netcat is a networking utility for reading from and writing to network connections.
- C: Nmap scans remote networks, not primarily local active connections.
- D: Ns is not a standard utility (likely referring to
nslookupfor DNS).
Q219. Which of the following allows the adversary to obtain password information over the network in a passive manner?
- A. Sniffing ✓
- B. Man in the middle
- C. Password cracking
- D. Account creation
Why A is correct: Sniffing is passive; it involves listening to network traffic. If credentials are transmitted in cleartext (e.g., Telnet, HTTP), they can be captured without altering traffic or interacting with the target.
Why others are incorrect:
- B: Man-in-the-middle is active; it involves intercepting and potentially modifying traffic.
- C: Password cracking is active; it involves computational effort against captured hashes.
- D: Account creation is an active administrative action.
Q220. Which of the following is an application that provides ARP spoofing?
- A. Cain & Abel ✓
- B. Evercrack
- C. Kismet
- D. John the Ripper
Why A is correct: Cain & Abel is a multipurpose tool for Windows that includes features for password recovery, network sniffing, and ARP spoofing (poisoning).
Why others are incorrect:
- B: Evercrack is not a standard security tool.
- C: Kismet is a wireless network detector and sniffer.
- D: John the Ripper is a password-cracking tool.
Q221. What technique might you use if you had access to a local (physical) network but the network used switches and you wanted to see all the traffic?
- A. DNS poisoning
- B. Phishing
- C. ARP spoofing ✓
- D. Packet fragmentation
Why C is correct: On a switched network, traffic is isolated. ARP spoofing tricks the switch and hosts into sending traffic to the attacker’s MAC address, allowing them to see all traffic on the local segment.
Why others are incorrect:
- A: DNS poisoning redirects domain name resolution, not local Layer 2 traffic.
- B: Phishing is a social engineering attack, not a network traffic interception technique.
- D: Packet fragmentation is used for IDS evasion, not traffic interception.
Q222. How does ARP spoofing work?
- A. Sending gratuitous ARP requests
- B. Sending gratuitous ARP responses ✓
- C. Filling up the ARP cache
- D. Flooding a switch
Why B is correct: ARP spoofing involves sending forged gratuitous ARP replies (responses) to a target, claiming that the attacker’s MAC address corresponds to a legitimate IP address (like the gateway).
Why others are incorrect:
- A: ARP requests ask “Who has this IP?”; responses claim ownership. Spoofing relies on unsolicited responses.
- C: Filling the ARP cache is the result, not the mechanism.
- D: Flooding a switch refers to MAC flooding, a different attack.
Q223. What tool can be used to spoof a MAC address?
- A. MAC and Cheese
- B. Cheesy MAC
- C. GodSMAC
- D. arpspoof ✓
Why D is correct: arpspoof (part of the dsniff suite) is a dedicated tool for sending forged ARP replies to redirect traffic, effectively spoofing MAC-to-IP associations.
Why others are incorrect:
- A, B, C: These are made-up names and not real security tools.
Q224. What is the process called when you’re trying to inject bogus entries into the ARP table?
- A. Enumeration
- B. RARP
- C. ARP poisoning ✓
- D. L2 dumping
Why C is correct: ARP poisoning (or ARP spoofing) is the technique of sending malicious ARP packets to a local network to associate the attacker’s MAC address with the IP address of a legitimate host.
Why others are incorrect:
- A: Enumeration is the process of gathering information about users and systems.
- B: RARP (Reverse ARP) is an obsolete protocol for discovering IP addresses from MAC addresses.
- D: L2 dumping is not a standard security term.
Q225. If you were to ARP poison the default gateway, what would be the expected results?
- A. You will receive traffic on that specific virtual local area network.
- B. You will receive all the traffic on the current network associated with the gateway. ✓
- C. You will not receive any traffic.
- D. You may cause a DoS on the network.
Why B is correct: By poisoning the gateway’s ARP cache (and the victims’), the attacker positions themselves as the man-in-the-middle for traffic leaving the local subnet, allowing them to intercept all traffic destined for external networks.
Why others are incorrect:
- A: It affects traffic associated with the gateway for the subnet, not necessarily limited to a specific VLAN unless VLAN hopping is also involved.
- C: The goal is to receive traffic; if done correctly, you will receive it.
- D: While a DoS can occur if the attacker doesn’t forward traffic, the primary expected result of the poisoning itself is interception.
