CND (312-38) Network Defense Simulation

Expert Analysis

1. Network Status: The logs show an internal workstation (192.168.10.45) resending authentication tokens to the App-Server. This indicates that a valid communication was captured and is now being injected back into the network to gain unauthorized access.

2. Identifying Behavior: This is a classic Active Attack. Unlike passive attacks that simply "listen," this attack modifies the state of the session by re-injecting captured packets.

3. Why Choice A is Correct: A Replay Attack is an active attack because the adversary captures a valid data transmission (like an authentication exchange) and later retransmits it to produce an unauthorized effect (e.g., bypassing login). This involves generating new traffic on the network.

4. Why Others are Wrong:

• Wireless Footprinting: This is a reconnaissance (passive) phase where the attacker maps out wireless networks without interacting with them.
• Passive Eavesdropping: As the name implies, it is passive; the attacker monitors traffic (sniffing) without any modification.
• Traffic Analysis: This involves observing the frequency, length, and flow of packets to infer communication patterns. No modification occurs.

5. Defensive Action: To prevent Replay Attacks, a CND professional should implement Session Tokens with Nonces (Number used once) or Time-stamping. If the server receives a packet with a timestamp that is too old or a nonce that has already been used, it drops the connection.