300-215 CBRFIR: Conducting Forensic Analysis and Incident Response Using Cisco Technologies for CybersecurityDemo

By Cisco · Question Mode

QuestionQ54

Incident Response Techniques

Question Image

Refer to the exhibit. While monitoring traffic, a security analyst observes unusual connections. What is the attack vector, and what action should be taken to prevent this type of event?

  • A DNS spoofing; encrypt communication protocols
  • B SYN flooding, block malicious packets
  • C ARP spoofing; configure port security
  • D MAC flooding; assign static entries
Explanation

ARP spoofing (ARP poisoning) uses forged ARP messages to create incorrect IP-to-MAC address mappings. Conflicting ARP replies and duplicate IP-address warnings indicate this condition. Configuring switch port security restricts which MAC addresses may use a switch port, reducing the ability of an unauthorized device to impersonate an endpoint’s MAC address.

Community Discussion

No comments yet. Be the first to start the discussion!