What distinguishes a Distributed Denial of Service (DDoS) attack from a traditional Denial of Service (DoS) attack?
Correct Answer: D
Denial of Service (DoS) and Distributed Denial of Service (DDoS) attacks are both designed to disrupt the availability of a network, service, or device by overwhelming it with traffic or requests. HPE Aruba Networking documentation, particularly in the context of Wireless Intrusion Prevention (WIP) and network security, often discusses these attacks to help administrators mitigate them. DoS Attack: A DoS attack is launched from a single source (e.g., one device or IP address) and aims to overwhelm a target (e.g., a server, network, or device) with traffic, making it unavailable to legitimate users. For example, a DoS attack might flood a server with SYN packets to exhaust its resources. DDoS Attack: A DDoS attack is a more sophisticated version of a DoS attack, where the attack is launched from multiple sources (e.g., a botnet of compromised devices). These sources work together to overwhelm the target, making the attack harder to mitigate because the traffic comes from many different IP addresses. Option A, "A DDoS attack originates from external devices, while a DoS attack originates from internal devices," is incorrect. Both DoS and DDoS attacks can originate from external or internal devices. The distinction is not about the location of the devices but the number of sources involved. Option B, "A DoS attack targets one server; a DDoS attack targets all the clients that use a server," is incorrect. Both DoS and DDoS attacks typically target a single entity (e.g., a server, network, or device) to disrupt its availability. They do not target "all the clients that use a server." Option C, "A DDoS attack targets multiple devices, while a DoS is designed to incapacitate only one device," is incorrect. Both DoS and DDoS attacks usually target a single device or service to overwhelm it. The difference lies in the source of the attack, not the number of targets. Option D, "A DDoS attack is launched from multiple devices, while a DoS attack is launched from a single device," is correct. This is the primary distinction between the two: a DDoS attack involves multiple sources (e.g., a botnet), while a DoS attack originates from a single source. The HPE Aruba Networking Security Guide states: "A Denial of Service (DoS) attack is launched from a single device to overwhelm a target, such as a server or network, making it unavailable to legitimate users. A Distributed Denial of Service (DDoS) attack, in contrast, is launched from multiple devices, often a botnet of compromised systems, to flood the target with traffic from many sources, making it harder to mitigate." (Page 20, DoS and DDoS Attacks Section) Additionally, the HPE Aruba Networking AOS-8 8.11 User Guide notes: "The Wireless Intrusion Prevention (WIP) system can detect DoS and DDoS attacks. A DoS attack originates from a single source, while a DDoS attack involves multiple sources working together to overwhelm the target, such as a server or network infrastructure." (Page 423, WIP Threat Detection Section) : HPE Aruba Networking Security Guide, DoS and DDoS Attacks Section, Page 20. HPE Aruba Networking AOS-8 8.11 User Guide, WIP Threat Detection Section, Page 423.
Question 37
What is an Authorized client as defined by ArubaOS Wireless Intrusion Prevention System (WIP)?
Correct Answer: C
In the context of ArubaOS Wireless Intrusion Prevention System (WIP), an authorized client is defined as a client that has successfully authenticated to an authorized Access Point (AP) and has passed encrypted traffic. This ensures that only clients which have been verified and authenticated according to the network's security policies are allowed to access network resources. Authentication typically involves credentials that are validated by a server, confirming the client's right to access the network securely.References: ArubaOS Wireless Intrusion Prevention System configuration and management guidelines.
Question 38
What is one benefit of a Trusted Platform Module (TPM) on an Aruba AP?
Correct Answer: A
The TPM (Trusted Platform Module) is a hardware-based security feature that can provide various security functions, one of which includes secure boot. Secure boot is a process where the TPM ensures that the device boots using only software that is trusted by the manufacturer. If the OS has been tampered with or infected with malware, the secure boot process can detect this and prevent the system from loading the compromised OS.
Question 39
This company has AOS-CX switches. The exhibit shows one access layer switch, Switch-2, as an example, but the campus actually has more switches. Switch-1 is a core switch that acts as the default router for end-user devices. What is a correct way to configure the switches to protect against exploits from untrusted end-user devices?
Correct Answer: B
The scenario involves AOS-CX switches in a two-tier topology with Switch-1 as the core switch (default router) on VLAN 100 and Switch-2 as an access layer switch with VLANs 15 and 25, where end-user devices connect. The goal is to protect against exploits from untrusted end-user devices, such as DHCP spoofing or ARP poisoning attacks, which are common threats in access layer networks. DHCP Snooping: This feature protects against rogue DHCP servers by filtering DHCP messages. It should be enabled on the access layer switch (Switch-2) where end-user devices connect, specifically on the VLANs where these devices reside (VLANs 15 and 25). DHCP snooping builds a binding table of legitimate IP-to-MAC mappings, which can be used by other features like ARP inspection. ARP Inspection: This feature prevents ARP poisoning attacks by validating ARP packets against the DHCP snooping binding table. It should also be enabled on the access layer switch (Switch-2) on VLANs 15 and 25, where untrusted devices are connected. Option B, "On Switch-2, enable DHCP snooping globally and on VLANs 15 and 25. Later, enable ARP inspection on the same VLANs," is correct. DHCP snooping must be enabled first to build the binding table, and then ARP inspection can use this table to validate ARP packets. This configuration should be applied on Switch-2, the access layer switch, because that's where untrusted end-user devices connect. Option A, "On Switch-1, enable ARP inspection on VLAN 100 and DHCP snooping on VLANs 15 and 25," is incorrect. Switch-1 is the core switch and does not directly connect to end-user devices on VLANs 15 and 25. DHCP snooping and ARP inspection should be enabled on the access layer switch (Switch-2) where the devices reside. Additionally, enabling ARP inspection on VLAN 100 (where the DHCP server is) is unnecessary since the DHCP server is a trusted device. Option C, "On Switch-2, enable BPDU filtering on all edge ports in order to prevent eavesdropping attacks by untrusted devices," is incorrect. BPDU filtering is used to prevent spanning tree protocol (STP) attacks by blocking BPDUs on edge ports, but it does not protect against eavesdropping or other exploits like DHCP spoofing or ARP poisoning, which are more relevant in this context. Option D, "On Switch-1, enable DHCP snooping on VLAN 100 and ARP inspection on VLANs 15 and 25," is incorrect for the same reason as Option A. Switch-1 is not the appropriate place to enable these features since it's not directly connected to the untrusted devices on VLANs 15 and 25. The HPE Aruba Networking AOS-CX 10.12 Security Guide states: "DHCP snooping should be enabled on access layer switches where untrusted end-user devices connect. It must be enabled globally and on the specific VLANs where the devices reside (e.g., dhcp-snooping vlan 15,25). This feature builds a binding table of IP-to-MAC mappings, which can be used by Dynamic ARP Inspection (DAI) to prevent ARP poisoning attacks. DAI should also be enabled on the same VLANs (e.g., ip arp inspection vlan 15,25) after DHCP snooping is configured, ensuring that ARP packets are validated against the DHCP snooping binding table." (Page 145, DHCP Snooping and ARP Inspection Section) Additionally, the guide notes: "Dynamic ARP Inspection (DAI) and DHCP snooping are typically configured on access layer switches to protect against exploits from untrusted devices, such as DHCP spoofing and ARP poisoning. These features should be applied to the VLANs where end-user devices connect, not on core switches unless those VLANs are directly connected to untrusted devices." (Page 146, Best Practices Section) : HPE Aruba Networking AOS-CX 10.12 Security Guide, DHCP Snooping and ARP Inspection Section, Page 145. HPE Aruba Networking AOS-CX 10.12 Security Guide, Best Practices Section, Page 146.
Question 40
What is a correct description of a stage in the Lockheed Martin kill chain?
Correct Answer: A
The Lockheed Martin Cyber Kill Chain is a framework that describes the stages of a cyber attack, from initial reconnaissance to achieving the attacker's objective. It is often referenced in HPE Aruba Networking security documentation to help organizations understand and mitigate threats. Option A, "In the delivery stage, the hacker delivers malware to targeted users, often with spear phishing methods," is correct. The delivery stage in the Lockheed Martin kill chain involves the attacker transmitting the weaponized payload (e.g., malware) to the target. Spear phishing, where the attacker sends a targeted email with a malicious attachment or link, is a common delivery method. This stage follows reconnaissance (gathering information) and weaponization (creating the malware). Option B, "In the installation phase, hackers seek to install vulnerabilities in operating systems across the network," is incorrect. The installation phase involves the attacker installing the malware on the target system to establish persistence (e.g., by creating a backdoor). It does not involve "installing vulnerabilities"; vulnerabilities are pre-existing weaknesses that the attacker exploits in the exploitation phase. Option C, "In the weaponization stage, malware installed in the targeted network seeks to attack intrusion prevention systems (IPS)," is incorrect. The weaponization stage occurs before delivery and involves the attacker creating a deliverable payload (e.g., combining malware with an exploit). The malware is not yet installed in the target network during this stage, and attacking an IPS is not the purpose of weaponization. Option D, "In the exploitation phase, hackers conduct social engineering attacks to exploit weak algorithms and crack user accounts," is incorrect. The exploitation phase involves the attacker exploiting a vulnerability (e.g., a software flaw) to execute the malware on the target system. Social engineering (e.g., phishing) is typically part of the delivery stage, not exploitation, and "exploiting weak algorithms" is not a standard description of this phase. The HPE Aruba Networking Security Guide states: "The Lockheed Martin Cyber Kill Chain describes the stages of a cyber attack. In the delivery stage, the attacker delivers the weaponized payload to the target, often using methods like spear phishing emails with malicious attachments or links. This stage follows reconnaissance (gathering information about the target) and weaponization (creating the malware payload)." (Page 18, Cyber Kill Chain Overview Section) Additionally, the HPE Aruba Networking AOS-8 8.11 User Guide notes: "Understanding the Lockheed Martin kill chain helps in threat mitigation. The delivery stage involves the attacker sending malware to the target, commonly through spear phishing, where a targeted email tricks the user into downloading the malware or clicking a malicious link." (Page 420, Threat Mitigation Section) : HPE Aruba Networking Security Guide, Cyber Kill Chain Overview Section, Page 18. HPE Aruba Networking AOS-8 8.11 User Guide, Threat Mitigation Section, Page 420.
