SY0-601 Exam Dumps | Security analysts are conducting an investigation of an attack that occurred inside the organization's

<< Prev Question Next Question >>

Question 27/92

Security analysts are conducting an investigation of an attack that occurred inside the organization's network.
An attacker was able to connect network traffic between workstation throughout the network. The analysts review the following logs:

The layer 2 address table has hundred of entries similar to the ones above. Which of the following attacks has MOST likely occurred?

A. MAC flooding

B. SQL injection

C. ARP poisoning

D. DNS spoofing

Recent Comments (The most recent comments are at the top.)

LG - Oct 30, 2023

Answer: MAC flooding

The question mentions that the table is on Layer 2 which is the Data link layer. The data-link layer is where switches operates on to move traffic. Switches will use MAC addresses to find the physical address of the device. This is because the Layer 2 address(MAC Address) will be unique on the local network.

MAC flooding is a cyber attack that overflows the MAC Table (Layer 2 Table) of switches by sending out invalid MAC addresses.

When a MAC Address table is full, the switch is no longer able to save new addresses, so it will enter into fail-open mode and begin broadcasting data (like a hub) to all ports. This will allow an attacker to get data packets intended for another computer and be able to steal sensitive information.

Question 27/92

Recent Comments (The most recent comments are at the top.)

LEAVE A REPLY

Download PDF File