Name:     ID: 
 
Email: 

Chap31AB

Multiple Choice
Identify the choice that best completes the statement or answers the question.
 

 1. 
(1 point) Which description best matches an on-path attack?
a.
An adversary blocks Wi‑Fi by transmitting strong noise on the same frequency.
b.
An adversary drives around looking for wireless beacons.
c.
An adversary overwhelms a switch with random MAC addresses.
d.
An adversary intercepts network traffic and can steal or change data before forwarding it.
 

 2. 
(1 point) A bank employee uses an untrusted network and an adversary captures session cookies and modifies a transfer request before it arrives at the bank server. In one sentence, what should the risk documentation emphasize?
a.
High impact because intercepted traffic can be altered to steal funds or data during an on-path attack.
b.
No impact because traffic always goes directly to the destination.
c.
Low likelihood because public Wi‑Fi is always encrypted.
d.
Low impact because cookies are not related to accounts.
 

 3. 
(1 point) A user sends a file over a network and the receiver gets a changed version of the file even though the sender did not modify it. Which attack could explain data being altered in transit?
a.
War driving
b.
Jamming attack
c.
MAC flooding attack
d.
On-path (man-in-the-middle) attack
 

 4. 
(1 point) At a coffee shop, a user sees two Wi‑Fi networks: 'CoffeeShop_WiFi' and 'CoffeeShop_WiFi_Free'. The user connects to the second one and later their traffic is found captured by a nearby laptop. What attack best describes this?
a.
DNS poisoning attack
b.
Jamming attack
c.
MAC flooding attack
d.
Evil-twin attack
 

 5. 
(1 point) Which detail most strongly indicates an evil-twin attack is possible?
a.
A DNS server records are changed by an authoritative server.
b.
A switch is forced into broadcast mode.
c.
A router blocks private IP addresses.
d.
A wireless access point uses an SSID that is similar or identical to a trusted network.
 

 6. 
(1 point) A user reports, 'The Wi‑Fi looked normal, but after I connected, I kept getting redirected to login pages.' Which attack involves tricking users into connecting to a fake wireless network?
a.
MAC spoofing
b.
ARP poisoning attack
c.
Evil-twin attack
d.
Jamming attack
 

 7. 
(1 point) Which outcome best matches a jamming attack?
a.
Users connect to a fake network that captures their traffic.
b.
A switch learns too many MAC addresses and broadcasts frames.
c.
A DNS server sends users to the wrong website.
d.
Legitimate wireless traffic is prevented between users and the access point.
 

 8. 
(1 point) A sports arena notices wireless ticket scanners fail only inside one section of seating, and the problem stops when security removes a suspicious transmitter. What attack is most consistent with this evidence?
a.
War driving
b.
Jamming attack (DoS)
c.
DNS poisoning attack
d.
MAC flooding attack
 

 9. 
(1 point) Which statement best describes what ARP poisoning does?
a.
It floods a wireless channel to block connections.
b.
It forces a switch to broadcast all frames by filling its CAM table.
c.
It sends fake ARP packets to change IP-to-MAC mappings so traffic is misdirected.
d.
It creates a fake DNS record so URLs go to the wrong site.
 

 10. 
(1 point) In an ARP poisoning incident, what does MAC spoofing refer to?
a.
Blocking Wi‑Fi with interference
b.
Driving around to detect wireless beacons
c.
Faking a MAC address to impersonate another device
d.
Changing a DNS record on a server
 

 11. 
(1 point) A student lab network uses ARP to reach the default gateway. If ARP poisoning succeeds, what impact should be documented?
a.
Impact is low because ARP only affects printers.
b.
Impact can be high because traffic can be intercepted or redirected to steal or alter data.
c.
Impact is none because ARP tables cannot be changed.
d.
Impact is limited to stronger Wi‑Fi signals.
 

 12. 
(1 point) A switch begins sending frames out of many ports like a hub. Logs show thousands of frames arriving with different source MAC addresses in seconds. What attack is most likely?
a.
Evil-twin attack
b.
MAC flooding attack
c.
DNS poisoning attack
d.
ARP poisoning attack
 

 13. 
(1 point) What is the main goal of a MAC flooding attack?
a.
Force a switch into broadcast mode so an adversary can capture more network traffic.
b.
Trick users into joining a fake Wi‑Fi network.
c.
Block Wi‑Fi by transmitting noise.
d.
Replace DNS entries to redirect web traffic.
 

 14. 
(1 point) A company uses a shared switch for sensitive devices. If MAC flooding succeeds, what is the most realistic risk impact?
a.
No risk because switches always encrypt frames.
b.
Risk is limited to password strength only.
c.
Only risk is slower printing, not security.
d.
Higher risk of data exposure because frames may be broadcast and easier to capture.
 

 15. 
(1 point) A technician notices network performance drops and a packet sniffer on one port suddenly sees traffic from many other devices. Which attack could cause this?
a.
MAC flooding attack
b.
Jamming attack
c.
War driving
d.
Evil-twin attack
 

 16. 
(1 point) Users type a correct bank URL, but their browsers are redirected to a fake login page. Investigators find a DNS server stored a fake record after being tricked by a server claiming to be authoritative. What attack is this?
a.
Jamming attack
b.
MAC flooding attack
c.
DNS poisoning attack
d.
ARP poisoning attack
 

 17. 
(1 point) Which outcome best matches DNS poisoning?
a.
A user connects to a fake Wi‑Fi access point.
b.
Wireless traffic is blocked by interference.
c.
A switch broadcasts all frames due to CAM table overflow.
d.
Browser traffic for a real URL is directed to a fake website for credential harvesting.
 

 18. 
(1 point) A district’s DNS server is poisoned and staff enter passwords on a fake site. What should a risk note emphasize?
a.
Low likelihood because DNS records cannot be changed.
b.
Low impact because DNS only affects email.
c.
No impact because browsers always ignore DNS responses.
d.
High impact because credentials can be harvested and users can be redirected without noticing.
 

 19. 
(1 point) A student says, 'The URL looked right, but it took me to a website with a different login form.' Which attack commonly uses a fake DNS record to send users to a fake site?
a.
DNS poisoning attack
b.
MAC spoofing
c.
War driving
d.
Jamming attack
 

 20. 
(1 point) An adversary walks around a building with a laptop and antenna to detect Wi‑Fi beacons and map where the signal leaks outside. What is this attack called?
a.
On-path attack
b.
War driving
c.
Jamming attack
d.
MAC flooding attack
 

 21. 
(1 point) Which activity best describes war driving?
a.
Intercepting and changing traffic between two devices.
b.
Filling a switch’s CAM table with random MAC addresses.
c.
Changing DNS records to redirect websites.
d.
Searching for wireless network beacons to learn network details and where signals extend beyond the building.
 

 22. 
(1 point) A company’s Wi‑Fi signal reaches far into the parking lot. If adversaries war drive the area, what risk statement is most accurate?
a.
Likelihood increases because signal leaks outside; impact depends on what access the wireless network allows.
b.
Impact is always none because war driving cannot find networks.
c.
Likelihood is zero because beacons are invisible.
d.
Likelihood is low because parking lots block radio waves.
 

 23. 
(1 point) A student finds a map online showing Wi‑Fi networks and their encryption types around town. Which attack technique is most likely used to collect that data?
a.
War driving
b.
MAC flooding
c.
DNS poisoning
d.
ARP poisoning
 

 24. 
(1 point) Which attack is a denial-of-service (DoS) that targets wireless communication by using electromagnetic interference?
a.
ARP poisoning attack
b.
DNS poisoning attack
c.
Evil-twin attack
d.
Jamming attack
 

 25. 
(1 point) A default gateway has an ARP table. Which attack tries to change that table so the attacker receives traffic meant for a victim?
a.
War driving
b.
ARP poisoning attack
c.
MAC flooding attack
d.
Jamming attack
 

 26. 
(1 point) Which attack overwhelms a switch with many different MAC addresses to make it broadcast frames?
a.
MAC flooding attack
b.
On-path attack
c.
DNS poisoning attack
d.
Evil-twin attack
 

 27. 
(1 point) A small business has no firewall on its network. How could an adversary exploit this to map the internal network?
a.
They could map the network only by reading paper manuals.
b.
They could send malicious traffic to probe devices and learn the network’s structure because nothing filters the scans.
c.
They could only attack if they have a physical key to the building.
d.
They could only attack if all devices are powered off.
 

 28. 
(1 point) Why does an improperly configured firewall increase the risk of disruption to network services?
a.
It prevents any devices from connecting to the router.
b.
It automatically disables encryption on Wi‑Fi.
c.
It may allow malicious traffic into the network, including traffic meant to overload or disrupt services.
d.
It forces all users to share the same password.
 

 29. 
(1 point) A school allows inbound traffic to many unused ports. Explain the main risk that should be documented.
a.
Inbound ports cannot be used unless the attacker is an employee.
b.
Open ports only affect printing, not security.
c.
Open ports can allow malicious traffic to enter for scanning, spoofing, or service disruption, increasing risk.
d.
Unused ports reduce risk because they confuse attackers.
 

 30. 
(1 point) An adversary sends traffic that pretends to be from a trusted device. How can weak firewall rules make this easier?
a.
If rules allow traffic based on limited checks, spoofed traffic may be accepted as legitimate and pass into the network.
b.
Spoofing can only happen on wired networks, not wireless.
c.
Spoofing is prevented automatically by using IPv4.
d.
Firewalls always verify identity with fingerprints.
 

 31. 
(1 point) Why does compromising one device increase the risk to other devices on the same LAN?
a.
Because compromising one device changes everyone’s MAC address.
b.
Because LANs automatically encrypt every file on every device.
c.
Because the attacker can attempt to access shared resources or exploit trust relationships to compromise additional devices.
d.
Because a compromised device stops all network traffic permanently.
 

 32. 
(1 point) A hospital documents an incident where one workstation was compromised. What additional risk should be noted about the LAN?
a.
There is no risk because only one device was affected.
b.
There is risk of lateral movement, where the adversary could spread to other devices and services on the LAN.
c.
Risk is only to public websites, not internal systems.
d.
Risk is limited to power outages only.
 

 33. 
(1 point) An attacker gains access to a receptionist computer. Explain how this could become a bigger problem for the entire office network.
a.
The attacker must first replace the router to do anything else.
b.
The attacker can only steal paper documents from the desk.
c.
The attacker cannot reach anything else if the computer is turned on.
d.
The attacker could use that foothold to target other internal devices and gain broader access through lateral movement.
 

 34. 
(1 point) A visitor finds an active ethernet port in a conference room and plugs in a laptop. How could this be exploited if port security is not enabled?
a.
The visitor could only steal data if they know the Wi‑Fi password.
b.
The visitor could gain access to the LAN through the switch port and launch attacks like DoS, MAC flooding, or MAC spoofing.
c.
The visitor would automatically be blocked by DNS.
d.
The visitor can only access the internet and cannot reach the LAN.
 

 35. 
(1 point) Why does enabling port security reduce risk when someone plugs into a switch port?
a.
Port security can restrict which devices (MAC addresses) are allowed, limiting unauthorized physical connections.
b.
Port security disables all user accounts automatically.
c.
Port security encrypts all files on the network.
d.
Port security prevents power failures.
 

 36. 
(1 point) A company has exposed data ports in a public lobby. What likelihood and impact concerns should be documented?
a.
Likelihood is higher because access is easy; impact can be high because an attacker could access the LAN and disrupt or capture traffic.
b.
Likelihood is low because ethernet ports are harmless; impact is none.
c.
Likelihood is zero because switches cannot be attacked; impact is low.
d.
Likelihood is high but impact is only slower Wi‑Fi.
 

 37. 
(1 point) How could physical access to a switch port lead to a denial-of-service (DoS) condition on a LAN?
a.
DoS only happens if the network uses IPv6.
b.
An attacker could connect and generate overwhelming traffic or use MAC flooding to degrade switch performance.
c.
DoS can only be done from outside the building over Wi‑Fi.
d.
An attacker could only cause DoS by changing a DNS record.
 

 38. 
(1 point) A network admin notices many different MAC addresses appearing on one switch port after hours. Explain what this could mean.
a.
It may indicate a MAC flooding attempt from a device plugged into that port to force the switch into broadcast behavior.
b.
It proves the firewall is working correctly.
c.
It means the router’s power supply is failing.
d.
It shows the Wi‑Fi password is too long.
 

 39. 
(1 point) Why is it risky when a wireless access point broadcasts outside a physically secure space?
a.
Broadcasting outside only affects device battery life.
b.
Attackers outside can gather information about the network and attempt interception or cracking attacks.
c.
It automatically disables the firewall.
d.
Wireless signals cannot be intercepted outside buildings.
 

 40. 
(1 point) A student says, 'The network is safe because the building is locked.' Why can this be false for wireless networks?
a.
Wireless networks can only be accessed with a physical key.
b.
Locks automatically encrypt wireless traffic.
c.
Locked doors stop radio waves.
d.
Wireless signals can extend outside, letting attackers attempt attacks without physical entry.
 

 41. 
(1 point) A guest network has no password. Explain how this makes attacks from inside the network easier.
a.
Open networks automatically block all traffic from new devices.
b.
A passwordless network is always encrypted.
c.
An adversary can join without authentication and launch attacks from within the network environment.
d.
Without a password, devices cannot connect at all.
 

 42. 
(1 point) Why does authenticating both users and devices reduce network risk?
a.
It makes it harder for adversaries to join the network and attack from inside.
b.
It guarantees that malware cannot exist.
c.
It forces all traffic to use the same IP address.
d.
It prevents power outages and hardware failures.
 

 43. 
(1 point) Explain how an adversary joining a network can help them bypass some perimeter defenses.
a.
Once inside, the adversary may be treated like an internal device, allowing easier access to internal services.
b.
Perimeter defenses become stronger when someone joins.
c.
Internal networks always block internal traffic.
d.
Joining the network automatically disables the attacker’s tools.
 

 44. 
(1 point) How can a rogue access point allow an adversary to access the LAN from outside the building?
a.
The rogue AP blocks wireless signals from leaving the building.
b.
The rogue AP turns off the switch CAM table.
c.
The rogue AP forces all users to change passwords.
d.
The adversary can connect wirelessly to the rogue AP and reach internal resources through that wired port.
 

 45. 
(1 point) A company finds an unknown access point connected to an internal switch. What impact should be documented?
a.
Low impact because extra access points only improve performance.
b.
Impact is limited to slower printers.
c.
High impact because it can bypass perimeter controls and give direct internal network access.
d.
No impact because firewalls stop all internal wireless connections.
 

 46. 
(1 point) Why is an open network port a vulnerability in physical spaces?
a.
Open ports automatically disable encryption.
b.
Open ports prevent any device from connecting.
c.
Open ports only affect battery life.
d.
It can be used to connect unauthorized devices, including rogue access points that bypass firewall protections.
 

 47. 
(1 point) A network uses weak wireless encryption. Explain how an adversary could exploit this to steal data.
a.
They would need to physically destroy the access point to steal data.
b.
Weak encryption only affects download speed, not security.
c.
They could attempt to break the encryption and then intercept or read network traffic in transit.
d.
They could only steal data by changing firewall rules on the router.
 

 48. 
(1 point) An adversary captures wireless packets and tries to recover readable data from them. Which vulnerability are they most likely exploiting?
a.
A locked server room door
b.
A firewall that blocks inbound scans
c.
Strong port security on switch ports
d.
Weak wireless encryption that can be broken
 

 49. 
(1 point) A single compromised device is called a 'foothold.' Explain why defenders worry about footholds on a LAN.
a.
Because a foothold can be leveraged for lateral movement to compromise more devices and services.
b.
Because LANs cannot have more than one infected device.
c.
Because footholds stop attackers from moving anywhere.
d.
Because footholds automatically fix vulnerabilities.
 

 50. 
(1 point) Explain how lack of device/user authentication can lead to attacks that disrupt network communication.
a.
Authentication only affects email, not network access.
b.
Attackers cannot disrupt networks once connected.
c.
If attackers can join easily, they can generate malicious traffic from inside to disrupt services or steal data.
d.
Disruption only happens through natural disasters.
 



 
         Start Over