Network Infrastructure & Security Weaknesses Flashcards

What is the security risk associated with 'asymmetric routing' in a network with stateful firewalls?

Answer: Stateful firewalls may drop legitimate return traffic that arrived on a different path than the outbound traffic

Stateful firewalls track connections based on the outbound flow; if return traffic takes a different path and hits a different firewall, the session state is not found and the packet is dropped.

During a network assessment, an assessor finds that the organization uses WEP encryption on several wireless access points. What is the critical weakness?

Answer: WEP's RC4 implementation with static IVs allows the encryption key to be cracked in minutes using passive traffic capture

WEP reuses initialization vectors (IVs) due to its 24-bit IV space, allowing tools like Aircrack-ng to recover the WEP key after capturing as few as 5,000-10,000 packets.

What network attack does the 'Fraggle attack' represent, and what infrastructure weakness does it exploit?

Answer: A UDP amplification attack using directed broadcast addresses on networks that forward them

Fraggle attacks send UDP Echo packets to a broadcast address with a spoofed victim source IP; all hosts on the segment reply to the victim, amplifying the attack traffic.

A CVA assessor finds that network devices have HTTP management interfaces enabled in addition to HTTPS. What remediation should be recommended?

Answer: Disable HTTP and enforce HTTPS-only management with HSTS to prevent protocol downgrade

Disabling HTTP entirely and enforcing HTTPS with HSTS eliminates the attack surface; HTTP redirect-only configurations remain vulnerable to SSL stripping attacks.

What is the significance of finding open port 161/UDP (SNMP) on externally-facing network devices during a CVA assessment?

Answer: It exposes device configuration data and may allow configuration changes if SNMP write community strings are configured

SNMP on external interfaces exposes network topology, device configurations, and running processes; SNMPv1/v2c with writable community strings can allow remote configuration changes.

Which condition describes a 'split horizon' violation in a network routing assessment context?

Answer: A routing update is sent back out the same interface on which it was received, potentially causing routing loops

Split horizon prevents routing loops by not advertising routes back on the interface they were learned from; disabling it on hub-and-spoke topologies requires poison reverse to maintain loop prevention.

An assessor discovers that an organization's IDS is deployed in tap/passive mode but the network uses full-duplex 10Gbps links with consistent high utilization. What vulnerability exists?

Answer: Packet loss at the tap under high load causes the IDS to miss attack traffic, creating blind spots

When tap-fed IDS sensors cannot process traffic at line rate, packets are dropped from analysis, allowing attackers to deliberately trigger high traffic volumes to blind the IDS.