CVA Network Infrastructure & Security Weaknesses 3 — Questions and Answers
Question 1: Which condition makes a network vulnerable to a DHCP starvation attack?
- No DHCP snooping configured on access layer switches (Correct answer)
- DHCP server running on a virtual machine
- Use of DHCP option 82 relay agent information
- Static IP assignments for all servers
Correct answer: No DHCP snooping configured on access layer switches
Without DHCP snooping, an attacker can flood the DHCP server with requests using spoofed MAC addresses, exhausting the IP address pool and causing denial of service.
Question 2: An assessor finds that an organization uses telnet for out-of-band management of network devices. What is the critical weakness?
- All management credentials and commands are transmitted in cleartext (Correct answer)
- Telnet sessions time out too quickly for effective management
- Telnet cannot support multi-factor authentication configurations
- Telnet is incompatible with modern network device firmware
Correct answer: All management credentials and commands are transmitted in cleartext
Telnet transmits all data including usernames, passwords, and configuration commands in plaintext, making credentials trivially capturable by any network sniffer.
Question 3: What does the term 'network perimeter erosion' describe in modern vulnerability assessments?
- The blurring of traditional boundaries due to cloud services, mobile devices, and remote work (Correct answer)
- Physical degradation of network equipment in harsh environments
- Gradual reduction of firewall rule sets over time
- Decrease in the number of DMZ segments in enterprise networks
Correct answer: The blurring of traditional boundaries due to cloud services, mobile devices, and remote work
Network perimeter erosion describes how cloud adoption, BYOD, and remote work have dissolved the clear inside/outside network boundary that traditional security models assumed.
Question 4: A vulnerability scan reveals that a network device responds to TCP port 23 and port 22 on its management interface. Which finding should be prioritized?
- Open Telnet (port 23) because it transmits credentials in cleartext (Correct answer)
- Open SSH (port 22) because it allows encrypted brute-force attacks
- Both ports equally because neither should be exposed
- Neither, as management interface exposure is expected behavior
Correct answer: Open Telnet (port 23) because it transmits credentials in cleartext
Telnet on port 23 is the higher priority finding because any intercepted session immediately exposes plaintext credentials, whereas SSH provides encrypted transport.
Question 5: Which technique allows an attacker to bypass port-based NAC (802.1X) by copying the MAC address of an authenticated device?
- MAC spoofing / identity theft against 802.1X MAC-based authentication bypass (Correct answer)
- ARP poisoning of the RADIUS server
- VLAN double-tagging to skip authentication
- TCP session splicing to hijack an authenticated port
Correct answer: MAC spoofing / identity theft against 802.1X MAC-based authentication bypass
MAC-based authentication bypass (MAB) relies solely on MAC address as the credential, which can be trivially spoofed by cloning an authenticated device's MAC address.
Question 6: During a network assessment, an assessor discovers that all inter-router links use /30 subnets and the network addresses are discoverable via SNMP. Why is this a concern?
- Attackers can map the internal routing topology and identify high-value pivot points (Correct answer)
- The /30 subnet size wastes IP address space unnecessarily
- SNMP v3 cannot enumerate /30 network prefixes correctly
- Inter-router subnets should always use /31 addressing per RFC 3021
Correct answer: Attackers can map the internal routing topology and identify high-value pivot points
Exposing internal routing infrastructure addressing via SNMP allows attackers to create accurate network maps and identify core routers as targets for disruption or pivoting.
Question 7: What security weakness is present when a firewall uses only stateless packet filtering for internet-facing rules?
- It cannot track TCP session state, allowing spoofed packets that appear to be part of established connections (Correct answer)
- It processes packets too slowly for high-bandwidth environments
- It cannot inspect encrypted HTTPS traffic
- It requires manual rule updates for every new application protocol
Correct answer: It cannot track TCP session state, allowing spoofed packets that appear to be part of established connections
Stateless firewalls evaluate each packet independently, so attackers can craft packets with ACK or RST flags set to bypass rules that only block SYN packets.
CVA Network Infrastructure & Security Weaknesses 3
Which condition makes a network vulnerable to a DHCP starvation attack?