CVA Network Infrastructure & Security Weaknesses 2 — Questions and Answers
Question 1: Which attack technique exploits the lack of authentication in the Spanning Tree Protocol (STP) to redirect network traffic?
- STP manipulation (Correct answer)
- ARP spoofing
- VLAN hopping
- MAC flooding
Correct answer: STP manipulation
STP manipulation allows an attacker to introduce a rogue switch that wins the root bridge election, causing traffic to flow through the attacker's device.
Question 2: A vulnerability assessor discovers that a router accepts SNMP queries using the community string 'public'. What is the primary risk?
- Unauthorized read access to device configuration and network topology data (Correct answer)
- Remote code execution on the router
- Physical access to the network closet
- Denial of service via SNMP floods
Correct answer: Unauthorized read access to device configuration and network topology data
The default 'public' SNMP community string grants read access to sensitive device information including interface details, routing tables, and configuration data.
Question 3: What is the purpose of a null route (blackhole route) in network security?
- To silently discard traffic destined for specific IP addresses (Correct answer)
- To redirect traffic to a honeypot
- To encrypt traffic between routers
- To segment VLANs on a core switch
Correct answer: To silently discard traffic destined for specific IP addresses
Null routes drop packets matching a specific destination prefix without sending ICMP unreachable messages, effectively blackholing unwanted traffic.
Question 4: During a CVA engagement, an assessor finds that BGP peers are configured without MD5 authentication. What is the most significant threat?
- Route injection attacks that can redirect internet traffic (Correct answer)
- Bandwidth exhaustion on WAN links
- DNS cache poisoning via BGP
- Physical interception of fiber links
Correct answer: Route injection attacks that can redirect internet traffic
Without BGP MD5 authentication, attackers on the same AS path can inject malicious route announcements, causing traffic hijacking or blackholing.
Question 5: Which network segmentation weakness allows an attacker on a guest VLAN to reach internal resources?
- VLAN misconfiguration allowing inter-VLAN routing without ACLs (Correct answer)
- Weak WPA2 passphrase on guest Wi-Fi
- Expired SSL certificate on the internal portal
- Default gateway IP address disclosure
Correct answer: VLAN misconfiguration allowing inter-VLAN routing without ACLs
When VLAN segmentation is implemented without proper ACLs on inter-VLAN routing interfaces, traffic between VLANs is permitted by default.
Question 6: What vulnerability does an assessor identify when a firewall permits inbound ICMP Type 0 (Echo Reply) packets without corresponding outbound ICMP Type 8 (Echo Request)?
- Covert channel for data exfiltration using ICMP tunneling (Correct answer)
- Reflected DDoS amplification vector
- TCP session hijacking opportunity
- ARP cache corruption via ICMP redirect
Correct answer: Covert channel for data exfiltration using ICMP tunneling
Allowing inbound ICMP replies without state tracking enables ICMP tunneling tools like iodine or ptunnel to smuggle data out of the network.
Question 7: A network assessment reveals that core switches have CDP (Cisco Discovery Protocol) enabled on external-facing interfaces. What information is exposed?
- Device model, IOS version, IP addresses, and VLAN configurations (Correct answer)
- Only the hostname and uptime of the device
- Encrypted credentials for privileged access
- Layer 7 application traffic metadata
Correct answer: Device model, IOS version, IP addresses, and VLAN configurations
CDP broadcasts detailed device information including hardware model, software version, native VLAN, and management IP addresses to adjacent devices.
CVA Network Infrastructure & Security Weaknesses 2
Which attack technique exploits the lack of authentication in the Spanning Tree Protocol (STP) to redirect network traffic?