300-445 Question 206
Single answerA global enterprise network is experiencing intermittent connectivity issues and degraded performance across multiple regions. Upon investigation, the network team finds that external traffic destined for the company's IP ranges is being redirected to malicious servers. Which of the following security issues is most likely causing this behavior?
- A
Distributed Denial-of-Service (DDoS) attack
- B
Border Gateway Protocol (BGP) hijacking
- C
DNS hijacking
- D
Route leaking
Show answer and explanation
Correct answer: B
Explanation
The scenario describes traffic destined for a company's IP ranges being redirected to malicious servers, which is a classic symptom of BGP hijacking. In this attack, a malicious actor announces incorrect BGP routes, tricking other routers into sending traffic through the attacker's network instead of the legitimate destination. This compromises network performance and security, making BGP hijacking the correct answer for this question.
- A. Incorrect.
A Distributed Denial-of-Service (DDoS) attack overwhelms a target network or service with massive amounts of traffic, causing disruption. However, DDoS does not involve redirecting traffic to malicious servers.
- B. Correct.
BGP hijacking occurs when a malicious actor announces false BGP routes, redirecting traffic meant for one network to another, often malicious, destination. This matches the described behavior of traffic redirection to malicious servers.
- C. Incorrect.
DNS hijacking involves altering DNS records to redirect users to malicious websites. While this could cause connectivity issues, it does not directly involve redirecting external traffic at the routing level, as described in the scenario.
- D. Incorrect.
Route leaking involves unauthorized announcement of internal routes to external networks, which can cause performance or security issues. However, it is not directly associated with traffic redirection to malicious servers in the given scenario.