CVA Network Infrastructure & Security Weaknesses 2

Question 1

Which attack technique exploits the lack of authentication in the Spanning Tree Protocol (STP) to redirect network traffic?

Accepted Answer

STP manipulation

Answer

STP manipulation allows an attacker to introduce a rogue switch that wins the root bridge election, causing traffic to flow through the attacker's device.

Question 2

A vulnerability assessor discovers that a router accepts SNMP queries using the community string 'public'. What is the primary risk?

Accepted Answer

Unauthorized read access to device configuration and network topology data

Answer

The default 'public' SNMP community string grants read access to sensitive device information including interface details, routing tables, and configuration data.

Question 3

What is the purpose of a null route (blackhole route) in network security?

Accepted Answer

To silently discard traffic destined for specific IP addresses

Answer

Null routes drop packets matching a specific destination prefix without sending ICMP unreachable messages, effectively blackholing unwanted traffic.

Question 4

During a CVA engagement, an assessor finds that BGP peers are configured without MD5 authentication. What is the most significant threat?

Accepted Answer

Route injection attacks that can redirect internet traffic

Answer

Without BGP MD5 authentication, attackers on the same AS path can inject malicious route announcements, causing traffic hijacking or blackholing.

Question 5

Which network segmentation weakness allows an attacker on a guest VLAN to reach internal resources?

Accepted Answer

VLAN misconfiguration allowing inter-VLAN routing without ACLs

Answer

When VLAN segmentation is implemented without proper ACLs on inter-VLAN routing interfaces, traffic between VLANs is permitted by default.

(CVA) Certified Vulnerability Assessor Practice Test

(CVA) Certified Vulnerability Assessor Practice Test

CVA Network Infrastructure & Security Weaknesses 2