Cyber Security Quiz: Network Attack Patterns
10 questions · exam conditions
0:00
Network Attack PatternsQuestion 1 of 10

Employees on a switched office LAN intermittently receive certificate warnings when accessing an internal web portal. Packet captures show unsolicited ARP replies claiming that the default gateway's IP address belongs to a workstation's MAC address. The workstation is not authorized to route traffic.

Which interpretation and mitigation best address the underlying attack pattern?

A DNS spoofing attack is redirecting portal names; enable DNSSEC validation on all internal resolvers.
An ARP spoofing attack is enabling interception; use DHCP snooping with dynamic ARP inspection on access switches.
A SYN flood is exhausting the gateway; enable SYN cookies and increase its connection backlog.
A MAC flooding attack is disabling switching; replace the portal certificate and shorten its validity period.
← Back to quizzes

Cyber Security Quiz

Cyber Security Quiz: Network Attack Patterns

Practice Network Attack Patterns in Cyber Security with focused quiz questions that help you check what you know, review explanations, and build confidence with test-style prompts.

What this quiz covers

This quiz focuses on Network Attack Patterns, giving you a quick way to practice the rules, question types, and explanations that matter most for Cyber Security.

How to use this quiz

Try each quiz question before looking at the correct answer. Use the explanations to review missed ideas, then come back to similar questions until the pattern feels familiar.

All questions

Question 1

Employees on a switched office LAN intermittently receive certificate warnings when accessing an internal web portal. Packet captures show unsolicited ARP replies claiming that the default gateway's IP address belongs to a workstation's MAC address. The workstation is not authorized to route traffic.

Which interpretation and mitigation best address the underlying attack pattern?

  1. A DNS spoofing attack is redirecting portal names; enable DNSSEC validation on all internal resolvers.
  2. An ARP spoofing attack is enabling interception; use DHCP snooping with dynamic ARP inspection on access switches. (correct answer)
  3. A SYN flood is exhausting the gateway; enable SYN cookies and increase its connection backlog.
  4. A MAC flooding attack is disabling switching; replace the portal certificate and shorten its validity period.
Explanation: When you see unsolicited ARP replies claiming ownership of an IP address that belongs to another device, you're looking at an ARP spoofing (also called ARP poisoning) attack. The key clue is in the protocol itself: ARP operates at Layer 2 and maps IP addresses to MAC addresses, but it has no authentication mechanism. An attacker can broadcast fake ARP replies, causing other devices to update their ARP cache with a malicious MAC address — redirecting traffic through the attacker's machine and enabling a man-in-the-middle (MITM) position. This explains the certificate warnings: the portal's TLS certificate doesn't match what the intercepting workstation presents. Answer B correctly identifies both the attack and the defense. DHCP snooping builds a trusted binding table of legitimate IP-to-MAC-to-port mappings, and Dynamic ARP Inspection (DAI) uses that table to validate ARP packets on untrusted switch ports — dropping any replies that don't match the binding table. Together, they directly neutralize ARP spoofing at the infrastructure level. Answer A describes DNS spoofing, which manipulates hostname resolution, not MAC-to-IP mappings. DNSSEC wouldn't stop an attacker who already controls Layer 2 traffic. Answer C describes a SYN flood, a volumetric DoS attack targeting TCP handshakes — there's no evidence of connection exhaustion here, and SYN cookies address a completely different threat. Answer D confuses MAC flooding, which overwhelms a switch's CAM table to force hub-like broadcasting, with the described attack; replacing a certificate doesn't address any Layer 2 attack. Your study tip: memorize the ARP spoofing → DAI pairing. Exam questions will often give you Layer 2 traffic anomalies and test whether you can match the correct switch-level control.

Question 2

An Internet-facing server receives a large number of TCP SYN packets with varied, apparently random source addresses. Few corresponding ACK packets arrive, and the server's queue of half-open connections becomes exhausted even though application CPU usage remains low.

Which mitigation most specifically addresses the resource-exhaustion mechanism described?

  1. Enable SYN cookies so connection state is deferred until the client returns a valid acknowledgment. (correct answer)
  2. Deploy a web application firewall so malformed HTTP requests are rejected after TCP setup.
  3. Require client TLS certificates so unauthenticated users cannot request application resources.
  4. Increase DNS cache duration so fewer clients need to resolve the server's address.
Explanation: When you see a question describing exhausted half-open connection queues with low CPU usage and spoofed source IPs, you're looking at a SYN flood attack — a classic Layer 4 denial-of-service technique. The key is matching the mitigation to the exact resource being consumed: TCP connection state, not application-layer resources. In a SYN flood, attackers exploit the TCP three-way handshake. The server allocates memory for each SYN, waits for an ACK that never comes, and eventually exhausts its half-open connection table. SYN cookies, answer A, solve this precisely by eliminating that premature state allocation. Instead of storing connection data on receipt of a SYN, the server encodes session information into the sequence number it sends back. State is only created if a valid ACK returns — meaning spoofed packets consume virtually no server resources. This directly targets the described mechanism. Answer B is wrong because a web application firewall operates at the HTTP/application layer (Layer 7), well above the TCP handshake. The connection queue is exhausted before any HTTP request is ever made, so a WAF never gets the chance to act. Answer C is similarly misaligned — TLS certificate validation happens after TCP is established, not during it, so it doesn't prevent the half-open connection buildup. Answer D is a red herring entirely; DNS caching affects name resolution latency and has no relationship to TCP connection state management. A useful pattern: match the mitigation to the OSI layer where the attack occurs. SYN floods are Layer 4 problems — only Layer 4 solutions like SYN cookies directly address them.

Question 3

A company permits network access only from MAC addresses listed in a switch configuration. An intruder observes an authorized device's MAC address, waits until that device disconnects, and configures the same address on another laptop.

Which change best addresses the weakness exploited by the intruder?

  1. Enable DNSSEC validation so the intruder cannot map internal hostnames to network addresses.
  2. Hide the wireless network name so the authorized device's MAC address is no longer transmitted.
  3. Use longer DHCP lease times so the authorized MAC address retains the same assigned IP address.
  4. Replace the MAC allowlist with port-based access control that authenticates a user or device credential. (correct answer)
Explanation: When a question describes someone bypassing a security control by impersonating a trusted identifier, ask yourself: does the control actually verify identity, or just recognize a label? That distinction is the heart of this question. MAC allowlisting is fundamentally weak because a MAC address is a self-reported value — any device can claim any address. The intruder exploited exactly this: they observed a valid address and simply declared "I am that device." The fix must introduce a mechanism that cannot be cloned so easily. D does this by replacing the allowlist with port-based access control (think IEEE 802.1X), which requires the connecting device or user to present a cryptographic credential — a certificate, token, or verified password — before gaining network access. Stealing a MAC address won't help if the attacker also needs a valid certificate they don't possess. A is a red herring. DNSSEC protects the integrity of DNS responses and prevents hostname spoofing, but the intruder never needed to resolve a hostname — they needed network admission, which DNSSEC doesn't govern. B misunderstands how MAC addresses travel. On a wired switch, hiding a wireless SSID does nothing. Even on Wi-Fi, MAC addresses are visible in 802.11 management frames regardless of SSID visibility, so the observation still happens. C actually worsens the problem. Longer DHCP leases mean the authorized device holds an IP longer, but they don't prevent a spoofed MAC from requesting and receiving that same IP once the lease eventually expires. Study tip: When evaluating authentication controls, always ask whether the credential being checked can be passively observed and replicated. If yes, the control is spoofable and needs cryptographic reinforcement.

Question 4

An online retailer becomes unavailable during an attack. Link utilization remains well below capacity, TCP handshakes complete normally, and most requests are syntactically valid HTTPS searches that trigger expensive database operations. The requests originate from many compromised hosts.

Which response is most appropriate for this attack pattern?

  1. Use application-aware rate controls, request challenges, and caching for expensive or repeatedly requested content. (correct answer)
  2. Increase only the Internet circuit capacity because the attack is primarily saturating network bandwidth.
  3. Enable dynamic ARP inspection because the bots are redirecting local traffic through unauthorized gateways.
  4. Enable SYN cookies because the bots are leaving a large number of handshakes half completed.
Explanation: When you see a question describing an attack where bandwidth is fine, TCP handshakes complete normally, but the site still collapses under legitimate-looking requests that strain back-end resources, you're looking at a Layer 7 (application-layer) DoS attack — specifically one exploiting expensive operations rather than raw volume. Your defense must operate at the same layer as the attack. Answer A is correct because it targets the actual problem: computationally costly requests from distributed sources. Application-aware rate limiting throttles suspicious request rates per client. CAPTCHA-style challenges distinguish bots from humans before database queries execute. Caching absorbs repeated expensive lookups so the database never sees them. Together, these defenses match the attack's mechanism precisely. Answer B fails because the passage explicitly states link utilization remains well below capacity. Buying more bandwidth does nothing when the bottleneck is database compute, not pipe size — you'd be solving the wrong problem entirely. Answer C is a red herring. Dynamic ARP inspection defends against ARP spoofing attacks on local network segments, where an attacker poisons ARP tables to intercept traffic. The attack described is inbound HTTPS traffic from external compromised hosts — ARP inspection is completely irrelevant here. Answer D misreads the clue. SYN cookies are the classic defense against SYN flood attacks, where attackers send TCP SYN packets but never complete the handshake, exhausting connection state tables. The passage tells you handshakes do complete normally, so there is no SYN flood to defend against. Study tip: On attack-response questions, always match the defense layer to the attack layer. Bandwidth attacks → network capacity; half-open connections → SYN cookies; valid but expensive requests → application controls.

Question 5

Compromised devices send small DNS queries to open recursive resolvers. Each query uses the victim's IP address as its source, causing the resolvers to send much larger responses to the victim. An access provider wants to stop its own customers from generating this kind of traffic.

Which provider control most directly prevents the customers from using the victim as the reflected destination?

  1. Filter outbound packets whose source addresses are not legitimately assigned to the sending customer network. (correct answer)
  2. Filter inbound DNS responses whenever their payload is larger than the provider's average DNS response.
  3. Require the victim to advertise its network through multiple anycast sites before accepting DNS traffic.
  4. Increase resolver cache sizes so repeated queries generate fewer authoritative DNS lookups.
Explanation: When you see a question about amplification attacks, ask yourself: at what point in the attack chain can the provider intervene? DNS amplification works by spoofing the victim's IP as the source, so resolvers send large responses to an address that never made the request. The access provider's leverage point is its own customers' outbound traffic — specifically, whether it allows packets with forged source addresses to leave its network. This is exactly what BCP 38 (ingress/egress filtering) addresses, and option A describes it precisely. If the provider filters outbound packets whose source addresses don't belong to the sending customer's legitimate address space, a compromised customer machine can't successfully spoof the victim's IP. The forged packet is dropped before it reaches any resolver, and the amplified response never gets generated — the attack is stopped at the source. Option B addresses the wrong direction entirely: filtering inbound DNS responses protects the provider's own customers from receiving amplified traffic, not from generating it. Option C puts the burden on the victim to reconfigure their network infrastructure (anycast), which is irrelevant to what the provider controls and doesn't prevent spoofed queries from leaving. Option D reduces authoritative lookups through caching, which is a performance optimization — it doesn't prevent spoofed queries from being sent or amplified responses from being directed at a victim. As a study tip, watch for questions that ask about who controls what. Amplification attack mitigations split across the reflector side, the victim side, and the originating network — here, the originating ISP's tool is source address validation via egress filtering.

Question 6

A monitoring appliance accepts one-way UDP commands if the packet's source IP address matches a trusted management host. Commands do not require a response, message authentication code, or session establishment. An attacker can send packets to the appliance but cannot receive traffic addressed to the trusted host.

Which conclusion and mitigation are most accurate?

  1. Source spoofing is ineffective because the attacker cannot receive replies; switching to TCP would fully authenticate the sender and prevent unauthorized commands.
  2. Source spoofing may succeed because no reply is needed; each command should be cryptographically authenticated and include a freshness value to prevent replay. (correct answer)
  3. ARP spoofing is required to exploit this design because routed UDP packets on external networks cannot carry source addresses chosen freely by the sender.
  4. DNS poisoning is required to exploit this design because the appliance must resolve the trusted host's name to an IP address before it evaluates incoming packets.
Explanation: When evaluating a protocol vulnerability, ask yourself two questions: what does the attacker need to succeed, and what verification does the system actually perform? Here, the appliance checks only the source IP field of incoming UDP packets — nothing else. IP source spoofing means an attacker crafts a packet and manually sets the source address to any value they choose, including the trusted management host's IP. UDP is connectionless, so the appliance never challenges the sender or waits for a handshake — it simply executes the command. Crucially, because no reply is required and no MAC or session token is checked, the attacker doesn't need to receive anything. The attack succeeds purely on the forged source address. The correct mitigation is B: require a cryptographic message authentication code (MAC) so the appliance can verify the packet genuinely came from a holder of the shared secret, and include a nonce or timestamp so recorded packets cannot be replayed later. A is wrong on both counts. TCP's three-way handshake does make blind spoofing harder, but it doesn't cryptographically authenticate the sender's identity — it only makes sequence numbers harder to guess. More importantly, the scenario's real flaw is absent authentication, not the transport protocol. C is wrong because ARP spoofing operates at Layer 2 on the same local network segment. An attacker sending routed packets across the internet can freely set the source IP without touching ARP at all. D is wrong because the appliance compares the packet's source IP address, not a hostname. DNS resolution is irrelevant to this check. Study tip: When a protocol skips authentication and needs no reply, always assume spoofing is trivially possible — the solution is always cryptographic verification, not a transport-layer swap.

Question 7

A traveler connects to an evil-twin wireless network using the same name as an airport's legitimate network. Before opening any business application, the traveler establishes a correctly configured full-tunnel VPN to the employer. The VPN client validates the employer's server certificate.

Which risk is most directly reduced by the VPN in this situation?

  1. The access point's ability to observe or alter protected business traffic after the VPN tunnel is established. (correct answer)
  2. The access point's ability to impersonate the wireless network name and accept the traveler's association.
  3. The access point's ability to block the VPN connection and deny all network availability.
  4. The access point's ability to collect radio metadata such as device presence and transmission timing.
Explanation: When evaluating what a VPN actually protects against, focus on where in the attack chain the VPN operates. A VPN creates an encrypted tunnel between the client and the employer's server, meaning all business traffic is ciphertext from the moment it leaves the device — before the evil-twin access point ever touches it. This is exactly why A is correct. The evil-twin AP sits between the traveler and the internet, giving it a perfect position to intercept or modify unencrypted traffic — a classic man-in-the-middle scenario. However, once a full-tunnel VPN is established and the server certificate is validated (confirming the traveler is talking to the real employer server, not another impostor), the AP sees only encrypted gibberish. It cannot read or tamper with the business traffic passing through it. B is wrong because the VPN does nothing to prevent the evil-twin attack itself. The rogue AP has already succeeded in getting the traveler to associate with it — that deception happened at the Wi-Fi layer, which VPN doesn't touch. C describes a denial-of-service or network-blocking scenario. A VPN doesn't prevent an AP from simply dropping your packets; if the attacker kills connectivity, the VPN tunnel dies too. This is a risk the VPN cannot mitigate. D refers to radio-layer metadata — things like which devices are present and when they transmit. This operates below the VPN layer entirely; encryption has no effect on RF signal timing or device association records. A useful mental model: VPNs protect payload confidentiality and integrity in transit, not the underlying network access mechanism or physical-layer observability. When a question lists multiple threats, ask yourself which layer each threat operates at, and match it to what VPN actually secures.

Question 8

A man-in-the-middle attacker intercepts a user's first attempt to visit a website over unencrypted HTTP. The attacker removes the site's redirect to HTTPS and continues proxying an HTTP version of the session. The website supports HTTPS but has not previously been visited by this browser.

Which control most directly prevents this downgrade from succeeding on the first visit?

  1. Enable SYN cookies so the browser verifies the server before accepting an HTTP redirect response.
  2. Issue a longer-lived TLS certificate so the attacker cannot modify the initial unencrypted HTTP redirect.
  3. Use DNS round-robin records so the browser can select a different server if HTTP is intercepted.
  4. Include the domain in browser HSTS preload lists so the browser requires HTTPS before sending the initial request. (correct answer)
Explanation: When you see a question about SSL/TLS downgrade attacks, focus on where in the connection lifecycle a control operates. The attacker here wins by intercepting the very first HTTP request — before any HTTPS negotiation begins. Any defense that relies on the server sending a redirect during that first exchange is already too late, because the attacker can strip it. This is exactly what HTTP Strict Transport Security (HSTS) preloading solves. Browsers ship with a hardcoded list of domains that must be contacted over HTTPS. When your domain is on that preload list, the browser enforces HTTPS locally — it never sends that initial HTTP request at all, giving the attacker nothing to intercept. D is correct because it eliminates the vulnerable window entirely, on the very first visit. A is a trap that conflates network-layer DoS mitigation with transport security. SYN cookies protect against TCP SYN flood attacks; they have no role in enforcing encrypted connections or validating redirect responses. B is wrong because certificate lifetime is irrelevant here. The attack doesn't involve forging or expiring a certificate — it simply strips the plaintext HTTP redirect before TLS ever starts. A longer-lived cert does nothing to prevent that. C is a distractor that misunderstands the threat model. DNS round-robin is a load-balancing technique. The attacker is operating at the TCP/HTTP layer, not at DNS. Switching to a different server still doesn't guarantee the browser will use HTTPS on that first request. Study tip: On questions about downgrade attacks, ask yourself: "Does this control act before the vulnerable exchange, or does it depend on that exchange completing safely?" Preloading works because it acts client-side, before any packet is sent.

Question 9

A news site experiences a sudden surge of requests from thousands of geographically distributed addresses immediately after a major event. Most clients request the same article, and server response times increase. The security team has not yet determined whether the traffic comes from readers or a botnet.

What is the best initial conclusion and response?

  1. The source diversity proves a DDoS attack; block every address that requested the article more than once.
  2. The popular content proves a flash crowd; disable DDoS monitoring to avoid rejecting legitimate readers.
  3. Either cause remains possible; examine client behavior and apply adaptive controls such as caching and measured rate limits. (correct answer)
  4. The increased latency proves a man-in-the-middle attack; replace the site's certificate before restoring service.
Explanation: When ambiguous traffic spikes occur, your first job is threat classification, not immediate action. The core challenge here is distinguishing a flash crowd (a legitimate surge driven by viral content) from a DDoS attack (malicious volumetric flooding). Both produce nearly identical symptoms: high request volume, distributed source IPs, and degraded response times. Because the symptoms overlap, you cannot responsibly declare either cause without behavioral evidence. This is why C is correct. The security team explicitly hasn't determined the cause yet, so the right posture is to preserve service for legitimate users while gathering data. Caching the popular article reduces server load regardless of whether traffic is benign or malicious — it's a win either way. Measured rate limits throttle abusive patterns without outright blocking readers. This adaptive, evidence-gathering approach is both operationally sound and ethically responsible. A commits the logical fallacy of treating geographic diversity as proof of a botnet. Flash crowds are also geographically distributed — that's what makes them look similar. Blocking repeat requesters would punish normal readers refreshing a breaking-news article. B makes the opposite mistake: treating popular content as proof of legitimacy. A well-designed botnet absolutely can target a trending article. Worse, disabling DDoS monitoring removes your visibility exactly when you need it most. D introduces a completely unrelated threat. Man-in-the-middle attacks involve traffic interception between endpoints, not volumetric server overload. Latency from high request volume has nothing to do with certificate integrity. Study tip: On security questions involving ambiguous evidence, watch for answers that jump to a single conclusion too quickly — real incident response always involves ruling out alternatives before acting decisively.

Question 10

An attacker poisons a recursive DNS cache so that bank.example resolves to a server controlled by the attacker. Customers enter the correct URL, and their browsers perform normal certificate and hostname validation. The bank's private key and trusted certificate authorities remain uncompromised.

What is the most accurate assessment of the attacker's ability to perform a transparent man-in-the-middle attack?

  1. The attacker can decrypt sessions because DNS resolution occurs before the TLS handshake, giving the attacker an opportunity to intercept credentials.
  2. The attacker can automatically obtain a valid certificate for bank.example because the poisoned DNS record demonstrates domain ownership to certificate authorities.
  3. The attacker cannot terminate TLS as the bank, but could relay bytes between client and server without being able to read or modify the protected content. (correct answer)
  4. The attacker cannot receive any client traffic because certificate validation occurs before the TCP connection is opened, blocking the redirect entirely.
Explanation: When a question asks whether an attacker can perform a transparent MitM attack, your mental framework should be: what does TLS actually protect, and what does it require? TLS provides both encryption and authentication — the server must prove its identity with a certificate signed by a trusted CA. These two properties are what you need to evaluate against each answer choice. Since the bank's private key is uncompromised and no trusted CA has issued a fraudulent certificate, the attacker cannot present a valid certificate for bank.example. When the client's browser performs hostname validation, it will receive the attacker's certificate, find a mismatch or untrusted issuer, and show a warning or hard error. The attacker therefore cannot terminate TLS on behalf of the bank — making C correct. The attacker receives the TCP connection but cannot complete a legitimate TLS handshake, so they cannot transparently read or modify the encrypted content. A contains a subtle but critical error: DNS resolution happening before TLS does not grant decryption ability. The attacker can redirect traffic, but interception of the TCP stream doesn't break the cryptographic guarantee of TLS. Timing of DNS vs. TLS is irrelevant to key material. B is wrong because DNS poisoning does not constitute valid domain ownership proof. Modern CA issuance methods (like ACME/Let's Encrypt) verify domain control through mechanisms such as HTTP file challenges or DNS TXT records that the real domain owner controls — not simply whether a DNS query resolves to your server. D is wrong because certificate validation happens during the TLS handshake, which occurs after TCP connection establishment. Traffic does reach the attacker's server; it just can't be decrypted or impersonated successfully. Study tip: Always separate DNS (routing/addressing) from TLS (authentication/encryption) in your analysis — DNS poisoning breaks routing integrity, but it cannot alone compromise cryptographic identity.