ExamGecko
Question list
Search
Search

List of questions

Search

Related questions











Question 16 - SY0-601 discussion

Report
Export

A security analyst has received several reports of an issue on an internal web application. Users state they are having to provide their credentials twice to log in. The analyst checks with the application team and notes this is not an expected behavior. After looking at several logs, the analyst decides to run some commands on the gateway and obtains the following output:

Which of the following BEST describes the attack the company is experiencing?

A.
MAC flooding
Answers
A.
MAC flooding
B.
URL redirection
Answers
B.
URL redirection
C.
ARP poisoning
Answers
C.
ARP poisoning
D.
DNS hijacking
Answers
D.
DNS hijacking
Suggested answer: C

Explanation:

The output of the “netstat -ano” command shows that there are two connections to the same IP address and port number. This indicates that there are two active sessions between the client and server.

The issue of users having to provide their credentials twice to log in is known as a double login prompt issue. This issue can occur due to various reasons such as incorrect configuration of authentication settings, incorrect configuration of web server settings, or issues with the client’s browser.

Based on the output of the “netstat -ano” command, it is difficult to determine the exact cause of the issue. However, it is possible that an attacker is intercepting traffic between the client and server and stealing user credentials. This type of attack is known as C. ARP poisoning. ARP poisoning is a type of attack where an attacker sends fake ARP messages to associate their MAC address with the IP address of another device on the network. This allows them to intercept traffic between the two devices and steal sensitive information such as user credentials.

asked 02/10/2024
Olga Trofimova
34 questions
User
Your answer:
0 comments
Sorted by

Leave a comment first