Network Infrastructure & Security Weaknesses Flashcards

Which network protocol is most susceptible to amplification-based DDoS attacks due to its stateless nature and small query/large response ratio?

Answer: DNS (Domain Name System)

DNS queries are small (~60 bytes) but responses can be 3,000+ bytes, providing amplification factors up to 50x when open resolvers are abused with spoofed source IPs.

A CVA candidate is assessing a network where ACLs on core routers permit traffic from RFC 1918 addresses arriving on internet-facing interfaces. What attack does this enable?

Answer: IP source address spoofing for bypassing IP-based access controls

Accepting RFC 1918 private address ranges on internet interfaces (ingress filtering failure) allows attackers to spoof internal IP addresses and potentially bypass IP-based ACLs.

What is the security implication of finding that a network switch has all unused ports in VLAN 1 (the default VLAN)?

Answer: Unused ports in the default VLAN can be used by unauthorized devices to access the network without specific VLAN assignment

Best practice is to assign unused ports to a dedicated 'dead' VLAN and disable them, preventing rogue devices from joining the default VLAN and potentially accessing management traffic.

An assessor identifies that a network uses hub devices at several access layer locations. What vulnerability does this introduce beyond collision domains?

Answer: All traffic is broadcast to every port, enabling passive sniffing of all communications by any connected host

Unlike switches, hubs repeat all incoming frames to all ports, so any device connected to a hub can passively capture all traffic traversing that segment without needing to perform active attacks.

What does 'route summarization misconfiguration' mean in the context of network vulnerability assessment?

Answer: Overlapping summary routes that cause traffic to be sent to incorrect next-hop destinations

Misconfigured route summarization can create black holes or routing loops when summary routes overlap with more-specific routes pointing to different paths.

Which finding indicates that a network is vulnerable to a man-in-the-middle attack at the routing layer?

Answer: OSPF or EIGRP running without neighbor authentication

Dynamic routing protocols without MD5 or SHA authentication allow any device on the subnet to inject false routing information and become a traffic relay.

A network assessor discovers that network time synchronization uses NTP without authentication across all infrastructure. What is the primary security concern?

Answer: Attackers can manipulate device clocks to invalidate certificates, corrupt logs, or bypass time-based access controls

NTP without authentication (NTPv3 MD5 or NTS) allows attackers to perform NTP spoofing attacks that shift device clocks, breaking TLS certificate validation, Kerberos tickets, and log correlation.