Network Infrastructure & Security Weaknesses Flashcards

Which condition makes a network vulnerable to a DHCP starvation attack?

Answer: No DHCP snooping configured on access layer switches

Without DHCP snooping, an attacker can flood the DHCP server with requests using spoofed MAC addresses, exhausting the IP address pool and causing denial of service.

An assessor finds that an organization uses telnet for out-of-band management of network devices. What is the critical weakness?

Answer: All management credentials and commands are transmitted in cleartext

Telnet transmits all data including usernames, passwords, and configuration commands in plaintext, making credentials trivially capturable by any network sniffer.

What does the term 'network perimeter erosion' describe in modern vulnerability assessments?

Answer: The blurring of traditional boundaries due to cloud services, mobile devices, and remote work

Network perimeter erosion describes how cloud adoption, BYOD, and remote work have dissolved the clear inside/outside network boundary that traditional security models assumed.

A vulnerability scan reveals that a network device responds to TCP port 23 and port 22 on its management interface. Which finding should be prioritized?

Answer: Open Telnet (port 23) because it transmits credentials in cleartext

Telnet on port 23 is the higher priority finding because any intercepted session immediately exposes plaintext credentials, whereas SSH provides encrypted transport.

Which technique allows an attacker to bypass port-based NAC (802.1X) by copying the MAC address of an authenticated device?

Answer: MAC spoofing / identity theft against 802.1X MAC-based authentication bypass

MAC-based authentication bypass (MAB) relies solely on MAC address as the credential, which can be trivially spoofed by cloning an authenticated device's MAC address.

During a network assessment, an assessor discovers that all inter-router links use /30 subnets and the network addresses are discoverable via SNMP. Why is this a concern?

Answer: Attackers can map the internal routing topology and identify high-value pivot points

Exposing internal routing infrastructure addressing via SNMP allows attackers to create accurate network maps and identify core routers as targets for disruption or pivoting.

What security weakness is present when a firewall uses only stateless packet filtering for internet-facing rules?

Answer: It cannot track TCP session state, allowing spoofed packets that appear to be part of established connections

Stateless firewalls evaluate each packet independently, so attackers can craft packets with ACK or RST flags set to bypass rules that only block SYN packets.