CEH-001 Spoofing Practice Questions

Which of the following countermeasure can specifically protect against both the MAC Flood and MAC Spoofing attacks?

• AA. Configure Port Security on the switch
• BB. Configure Port Recon on the switch
• CC. Configure Switch Mapping
• DD. Configure Multiple Recognition on the switch

Cyber Criminals have long employed the tactic of masking their true identity. In IP spoofing, an attacker gains unauthorized access to a computer or a network by making it appear that a malicious message has come from a trusted machine, by "spoofing" the IP address of that machine. How would you detect IP spoofing?

• AA. Check the IPID of the spoofed packet and compare it with TLC checksum. If the numbers match then it is spoofed packet
• BB. Probe a SYN Scan on the claimed host and look for a response SYN/FIN packet, if the connection completes then it is a spoofed packet
• CC. Turn on 'Enable Spoofed IP Detection' in Wireshark, you will see a flag tick if the packet is spoofed
• DD. Sending a packet to the claimed host will result in a reply. If the TTL in the reply is not the same as the packet being checked then it is a spoofed packet