312-50 exam dumps: questions 201 to 300 of 473

Correct answer: A

• A. Correct.

  Correct. On a switched Ethernet network, normal access ports receive broadcasts, multicasts, and unicast frames destined for that port's MAC address. To observe another host's traffic from a separate port without touching the endpoint, the standard and appropriate approach is to configure a SPAN (Switched Port Analyzer) or mirror port on the switch. This copies traffic from the target port or VLAN to the analyst's monitoring port, allowing Wireshark or another sniffer to capture the packets reliably.

• B. Incorrect.

  Incorrect. Promiscuous mode allows the network interface and capture software to accept frames that reach the interface even if they are not addressed to that NIC. However, on a switched network, the switch does not normally forward other hosts' unicast traffic to your port in the first place. Promiscuous mode is useful on shared media or when traffic is already being delivered to the interface, but by itself it does not bypass switch forwarding logic.

• C. Incorrect.

  Incorrect. Excess ARP traffic may generate additional broadcasts, but it will not cause the switch to flood unrelated unicast traffic from the target workstation to your port under normal operation. This reflects a common misconception that simply increasing broadcast or ARP activity makes a switch behave like a hub. It does not provide a controlled or reliable way to capture another host's traffic.

• D. Incorrect.

  Incorrect. MAC spoofing to impersonate the target host is not the appropriate solution here. At best, it can create a MAC table conflict or disrupt connectivity; at worst, it can amount to an active attack such as traffic hijacking or denial of service. It also does not provide a clean, authorized, and stable method for passive monitoring during an assessment. The scenario specifically asks for the most appropriate action, and switch port mirroring is the standard defensive and assessment-friendly method.

Correct answers: A, B, D

• A. Correct.

  Correct. Dynamic ARP Inspection helps mitigate ARP spoofing/poisoning by validating ARP packets against trusted bindings, typically learned through DHCP snooping. DHCP snooping builds a binding table of legitimate IP-to-MAC-to-port mappings, and DAI uses that information to reject forged ARP replies. This directly addresses the attack described, where the rogue device used ARP spoofing to intercept traffic on a switched network.

• B. Correct.

  Correct. Port security on access ports reduces the likelihood that a rogue device can simply plug into an unused wall jack and participate on the network. By limiting the number of MAC addresses per port and optionally statically or dynamically binding approved MAC addresses, the switch can shut down or restrict a port when an unauthorized device appears. This is a practical countermeasure against unauthorized network access that enables sniffing attacks.

• C. Incorrect.

  Incorrect. Disabling DNS recursion can reduce certain DNS abuse scenarios, especially on public-facing resolvers, but it does not address sniffing on a LAN or ARP spoofing between local hosts. A candidate might choose this option because it sounds like a general hardening measure, but it is not relevant to preventing packet capture through local man-in-the-middle techniques.

• D. Correct.

  Correct. Even if an attacker gains a position to observe traffic, enforcing encrypted protocols significantly reduces the value of captured packets. Replacing cleartext services such as HTTP, Telnet, FTP, and older SNMP versions with HTTPS, SSH, SFTP/FTPS, and SNMPv3 helps protect confidentiality. This is a core sniffing countermeasure because it prevents credential and data disclosure from passive or active interception.

• E. Incorrect.

  Incorrect. Increasing CAM table size is not a standard or primary countermeasure for sniffing attacks. CAM table flooding attacks attempt to overflow a switch's forwarding table so it behaves more like a hub, but simply increasing table size does not reliably prevent abuse and does nothing specific against ARP spoofing. Proper controls include port security, storm control, segmentation, and validation features such as DAI rather than relying on table size changes.

Correct answer: A

• A. Correct.

  Correct. Moving web applications from HTTP to HTTPS with TLS is a primary sniffing countermeasure because it protects credentials, cookies, and application data in transit. Even if an attacker captures packets on the local segment through a compromised host or ARP-based interception, properly implemented TLS prevents them from reading the contents. Enforcing secure sessions also helps prevent downgrade or mixed-content issues that could expose sensitive data.

• B. Incorrect.

  Incorrect. ARP cannot simply be 'disabled' on normal IPv4 client workstations because it is a fundamental protocol used to resolve local IP addresses to MAC addresses on Ethernet networks. While ARP spoofing protections such as Dynamic ARP Inspection, static ARP entries in limited cases, or switch security features can reduce certain man-in-the-middle attacks, disabling ARP is not a practical or valid enterprise countermeasure.

• C. Incorrect.

  Incorrect. Increasing switch port speed does nothing to protect confidentiality of traffic. Sniffing risk is not meaningfully reduced by lower latency or higher bandwidth. If an attacker can access traffic through a compromised endpoint, mirrored port, hub-like exposure, SPAN misuse, or man-in-the-middle positioning, packet contents remain readable when transmitted in cleartext.

• D. Incorrect.

  Incorrect. ICMP is commonly used for diagnostics and network control, but blocking it does not prevent sniffers from capturing HTTP credentials or session cookies. Packet sniffing tools capture traffic based on network access, interface mode, and traffic visibility; they do not rely on ICMP to read unencrypted application-layer data.

Correct answer: A

• A. Correct.

  Correct. In this scenario, the immediate problem is that an unauthorized device can be plugged into any open access port and begin capturing traffic. On managed switches, port security is a practical first-line countermeasure because it restricts which devices can use a port, typically by limiting learned MAC addresses, using sticky MAC, or shutting down a port on violation. This does not eliminate all sniffing risks, but it directly reduces the ability of a rogue laptop to join the network from an unused wall jack. It is a well-established Layer 2 control for limiting unauthorized access on switched networks.

• B. Incorrect.

  Incorrect. ARP is required for normal IPv4 communication on a local network segment. Hosts cannot simply disable ARP and still function on standard Ethernet networks. The misconception is that because ARP spoofing is associated with sniffing, removing ARP would solve the problem. In practice, the proper mitigation is to use protections such as Dynamic ARP Inspection, DHCP snooping, static ARP in limited cases, segmentation, and encryption where appropriate, not disabling ARP entirely.

• C. Incorrect.

  Incorrect. Increasing uplink bandwidth has no meaningful effect on preventing packet sniffing by a rogue endpoint on an access port. Sniffing countermeasures focus on access control, segmentation, switch security features, and encryption. This distractor reflects a misunderstanding between performance tuning and security controls.

• D. Incorrect.

  Incorrect. DNS TTL settings affect how long clients cache DNS answers; they do not prevent local packet capture or stop a rogue host from joining the LAN and sniffing traffic. Someone might choose this option if they confuse name resolution behavior with traffic confidentiality, but TTL values are unrelated to mitigating switched-network sniffing.

Correct answer: A

• A. Correct.

  Correct. A classic active sniffing detection approach is to send deliberately crafted frames, such as ARP requests with unusual Layer 2 addressing, to see whether a host in promiscuous mode processes and responds to traffic it should normally discard. A NIC operating normally should ignore frames not addressed to its MAC address (except broadcasts/multicasts as appropriate). A response can indicate that the interface or capture stack is accepting packets beyond normal filtering.

• B. Incorrect.

  Incorrect. A TCP connect scan may reveal exposed services, but the number of open ports has no reliable relationship to whether a host is sniffing traffic. This distractor reflects the common misconception that 'more services' implies 'more suspicious behavior.' Sniffing detection focuses on packet-handling behavior, not general service exposure.

• C. Incorrect.

  Incorrect. Oversized ICMP echo tests are more relevant to MTU, fragmentation, or protocol-stack robustness issues. Improper fragmentation behavior does not specifically indicate promiscuous mode or packet capture activity. Someone might choose this because it sounds like a low-level network test, but it is not a recognized technique for detecting sniffers.

• D. Incorrect.

  Incorrect. Reviewing the switch CAM/MAC address table can help detect certain Layer 2 anomalies such as unauthorized bridging, MAC flooding effects, or devices acting like small switches, but it does not directly identify a host simply running a sniffer in promiscuous mode. A standard sniffer on an endpoint usually does not cause the switch to learn multiple MAC addresses on that port.