300-445 Question 204
Single answerAn enterprise network is experiencing intermittent connectivity issues and degraded performance. Upon investigation, you observe that certain IP prefixes originally belonging to the organization are being advertised from an unauthorized source. What could be the most likely cause of this issue?
- A
DDoS attack overwhelming the network infrastructure
- B
BGP hijacking by a malicious actor
- C
DNS hijacking redirecting traffic to malicious domains
- D
Route leaking by a misconfigured or malicious third-party network
Show answer and explanation
Correct answer: B
Explanation
The issue described in the scenario, unauthorized advertisement of IP prefixes, is characteristic of BGP hijacking. This occurs when a malicious actor or misconfiguration causes incorrect routing advertisements, leading to traffic being misrouted or intercepted. Understanding how BGP hijacking impacts network performance is critical for ensuring enterprise network assurance.
- A. Incorrect.
A DDoS attack involves overwhelming a network with traffic but does not involve unauthorized advertisement of IP prefixes. This is not relevant to the scenario.
- B. Correct.
BGP hijacking occurs when a malicious actor advertises IP prefixes not belonging to them, causing traffic to be misrouted. This matches the described issue.
- C. Incorrect.
DNS hijacking involves redirecting DNS resolution to malicious servers. While it can affect network performance, it does not align with the unauthorized advertisement of IP prefixes.
- D. Incorrect.
Route leaking involves the unintended redistribution of routing information, which can cause connectivity issues, but it is not the same as unauthorized prefix advertisement.