200-201 Question 146
Select 4A cybersecurity analyst detects unusual behavior on their network where a legitimate service, used for secure communication, is being intercepted and altered by an unauthorized actor. Which of the following actions should the analyst take to confirm and address a potential Man-in-the-Middle (MitM) attack?
- A
Inspect the server's SSL/TLS certificate to verify its authenticity and validity.
- B
Examine the network traffic for suspicious patterns, such as mismatched IP addresses or altered data payloads.
- C
Reboot the affected server to clear any temporary issues with the service.
- D
Review DNS logs for any signs of DNS spoofing or redirection to rogue servers.
- E
Enable port mirroring on the switch to monitor detailed traffic flows.
Show answer and explanation
Correct answers: A, B, D, E
Explanation
Man-in-the-Middle (MitM) attacks involve intercepting and potentially altering communications between two parties. To confirm and mitigate such an attack, it is essential to verify SSL/TLS certificates to ensure authenticity, analyze network traffic for suspicious activity, investigate DNS spoofing attempts, and monitor traffic flows using tools like port mirroring. Rebooting a server does not address the underlying network or security vulnerabilities that allow the attack to occur.
- A. Correct.
Inspecting the SSL/TLS certificate can help detect if an attacker is presenting a fraudulent certificate to intercept encrypted traffic.
- B. Correct.
Examining network traffic can reveal anomalies indicative of a MitM attack, such as altered data or unexpected IP routing.
- C. Incorrect.
Rebooting the server is not an effective method for detecting or mitigating a MitM attack, as it does not address the root cause of the issue.
- D. Correct.
Reviewing DNS logs can uncover evidence of DNS spoofing, a common tactic used in MitM attacks to redirect users to malicious servers.
- E. Correct.
Enabling port mirroring allows detailed monitoring of traffic, which is crucial for identifying and investigating MitM activities.