300-445 Question 202
Single answerWhile monitoring your enterprise network, you notice unusually high latency and packet loss across multiple critical services. Upon further investigation, you identify that traffic destined for your servers is being redirected to unknown IP addresses. Which type of attack is MOST LIKELY occurring, and what should you analyze to confirm the issue?
- A
DDoS attack; analyze traffic patterns for a sudden spike in requests to your servers
- B
DNS hijacking; investigate DNS resolution logs to check if legitimate domain queries are being redirected
- C
BGP hijacking; review BGP route advertisements to detect unauthorized changes in prefix announcements
- D
Route leaking; analyze routing tables to identify if private prefixes are improperly advertised to external peers
Show answer and explanation
Correct answer: C
Explanation
The symptoms described, high latency, packet loss, and redirection of traffic, are indicative of BGP hijacking, where malicious actors manipulate BGP advertisements to reroute traffic to unauthorized IP addresses. Analyzing BGP route advertisements for unauthorized changes is critical to confirming this type of attack.
- A. Incorrect.
DDoS attacks typically overwhelm servers with a flood of traffic, causing resource exhaustion. However, this scenario describes traffic being redirected to unknown IPs, which does not align with the characteristics of a DDoS attack.
- B. Incorrect.
DNS hijacking involves altering DNS resolution to redirect legitimate domain queries to malicious sites. While similar in outcome, the problem here is related to routing rather than DNS resolution.
- C. Correct.
BGP hijacking occurs when an unauthorized entity advertises IP prefixes that it does not own, causing traffic meant for legitimate destinations to be redirected. This matches the scenario described, where traffic is redirected to unknown IPs.
- D. Incorrect.
Route leaking involves the improper advertisement of internal routes to external networks, which can lead to routing inefficiencies or data exposure. However, it does not specifically explain the redirection of traffic to unknown IPs as described in the scenario.