312-50V12 practice question 9 of 10

A large corporate network is being subjected to repeated sniffing attacks. To increase security, the company’s IT department decides to implement a…

A large corporate network is being subjected to repeated sniffing attacks. To increase security, the company’s IT department decides to implement a combination of several security measures. They permanently add theMAC address of the gateway to the ARP cache, switch to using IPv6 instead of IPv4, implement the use of encrypted sessions such as SSH instead of Telnet, and use Secure File Transfer Protocol instead of FTP. However, they are still faced with the threat of sniffing. Considering the countermeasures, what should be their next step to enhance network security?

Answer options

A: Use HTTP instead of HTTPS for protecting usernames and passwords

B: Implement network scanning and monitoring tools Correct answer

C: Enable network identification broadcasts

D: Retrieve MAC addresses from the OS

Correct Answer:

B. Implement network scanning and monitoring tools

Explanation

The organization has implemented several preventative controls: static ARP entries to thwart ARP poisoning, IPv6, and encrypted protocols (SSH, SFTP) to protect data in transit. However, sniffing can still occur, for example, from a compromised endpoint within the network or via a physical tap. Since preventative measures are not foolproof, the next logical step is to implement detective controls. Network scanning and monitoring tools (like Intrusion Detection Systems - IDS) can analyze traffic patterns, detect anomalies such as a network interface card (NIC) in promiscuous mode, and alert administrators to potential sniffing activity, thereby enhancing overall security posture.

Why Incorrect

A. Using HTTP instead of HTTPS would remove encryption for web traffic, making the network more vulnerable to sniffing, which is counterproductive to the stated goal.
C. Enabling network identification broadcasts can expose more information about the network's structure and devices, potentially aiding an attacker rather than securing the network.
D. Retrieving MAC addresses from the OS is a basic administrative task, not an advanced security countermeasure. The team is already manipulating ARP caches, indicating this level of knowledge.

References

1. NIST Special Publication 800-94. (2007). Guide to Intrusion Detection and Prevention Systems (IDPS). Section 2.1 discusses the role of IDPS in monitoring networks for malicious activity, which includes detecting sniffing attempts.

2. Stallings, W., & Brown, L. (2018). Computer Security: Principles and Practice (4th ed.). Pearson. Chapter 21, "Intrusion Detection," details how network-based IDS monitors traffic for suspicious patterns, which is a direct countermeasure to detect ongoing sniffing.

3. MIT OpenCourseWare. (2014). 6.857 Computer and Network Security, Spring 2014. Lecture 10 notes discuss network attacks and defenses, highlighting monitoring as a key defensive strategy alongside encryption.

Keep practicing

Take the free 312-50V12 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test