Network Infrastructure & Security Weaknesses Flashcards

Which attack technique exploits the lack of authentication in the Spanning Tree Protocol (STP) to redirect network traffic?

Answer: STP manipulation

STP manipulation allows an attacker to introduce a rogue switch that wins the root bridge election, causing traffic to flow through the attacker's device.

A vulnerability assessor discovers that a router accepts SNMP queries using the community string 'public'. What is the primary risk?

Answer: Unauthorized read access to device configuration and network topology data

The default 'public' SNMP community string grants read access to sensitive device information including interface details, routing tables, and configuration data.

What is the purpose of a null route (blackhole route) in network security?

Answer: To silently discard traffic destined for specific IP addresses

Null routes drop packets matching a specific destination prefix without sending ICMP unreachable messages, effectively blackholing unwanted traffic.

During a CVA engagement, an assessor finds that BGP peers are configured without MD5 authentication. What is the most significant threat?

Answer: Route injection attacks that can redirect internet traffic

Without BGP MD5 authentication, attackers on the same AS path can inject malicious route announcements, causing traffic hijacking or blackholing.

Which network segmentation weakness allows an attacker on a guest VLAN to reach internal resources?

Answer: VLAN misconfiguration allowing inter-VLAN routing without ACLs

When VLAN segmentation is implemented without proper ACLs on inter-VLAN routing interfaces, traffic between VLANs is permitted by default.

What vulnerability does an assessor identify when a firewall permits inbound ICMP Type 0 (Echo Reply) packets without corresponding outbound ICMP Type 8 (Echo Request)?

Answer: Covert channel for data exfiltration using ICMP tunneling

Allowing inbound ICMP replies without state tracking enables ICMP tunneling tools like iodine or ptunnel to smuggle data out of the network.

A network assessment reveals that core switches have CDP (Cisco Discovery Protocol) enabled on external-facing interfaces. What information is exposed?

Answer: Device model, IOS version, IP addresses, and VLAN configurations

CDP broadcasts detailed device information including hardware model, software version, native VLAN, and management IP addresses to adjacent devices.