312-50 Question 203
Single answer▪ Sniffing CountermeasuresA security consultant is assessing an enterprise LAN where users in the same office connect to unmanaged switches and access internal web applications over HTTP. During a controlled test, the consultant demonstrates that a compromised workstation can capture coworkers' session cookies and credentials using packet-sniffing tools. Management wants the most effective countermeasure that reduces the value of intercepted traffic without requiring a full network redesign. Which action should the consultant recommend first?
- A
Migrate the internal web applications from HTTP to HTTPS using TLS and enforce secure authentication sessions
- B
Disable ARP on client workstations so they cannot be targeted by sniffing attacks
- C
Increase switch port speeds to reduce packet latency and make sniffing less reliable
- D
Block ICMP traffic between user VLANs to prevent packet capture tools from seeing credentials
Show answer and explanation
Correct answer: A
Explanation
The scenario focuses on sniffing countermeasures in a practical enterprise environment. Because the immediate problem is that credentials and session cookies are visible in captured packets, the highest-value first step is to encrypt the application traffic with HTTPS using TLS. This aligns with widely accepted guidance from sources such as NIST and vendor security best practices: sensitive data should be protected in transit with strong cryptographic protocols. While switched networks reduce casual sniffing compared to hubs, they do not eliminate attacks from compromised endpoints or man-in-the-middle techniques such as ARP spoofing. Additional controls like Dynamic ARP Inspection, port security, network segmentation, and 802.1X can further reduce exposure, but they do not replace the need to encrypt sensitive traffic. In this case, TLS most directly reduces the usefulness of intercepted packets without requiring a full network redesign.
- A. Correct.
Correct. Moving web applications from HTTP to HTTPS with TLS is a primary sniffing countermeasure because it protects credentials, cookies, and application data in transit. Even if an attacker captures packets on the local segment through a compromised host or ARP-based interception, properly implemented TLS prevents them from reading the contents. Enforcing secure sessions also helps prevent downgrade or mixed-content issues that could expose sensitive data.
- B. Incorrect.
Incorrect. ARP cannot simply be 'disabled' on normal IPv4 client workstations because it is a fundamental protocol used to resolve local IP addresses to MAC addresses on Ethernet networks. While ARP spoofing protections such as Dynamic ARP Inspection, static ARP entries in limited cases, or switch security features can reduce certain man-in-the-middle attacks, disabling ARP is not a practical or valid enterprise countermeasure.
- C. Incorrect.
Incorrect. Increasing switch port speed does nothing to protect confidentiality of traffic. Sniffing risk is not meaningfully reduced by lower latency or higher bandwidth. If an attacker can access traffic through a compromised endpoint, mirrored port, hub-like exposure, SPAN misuse, or man-in-the-middle positioning, packet contents remain readable when transmitted in cleartext.
- D. Incorrect.
Incorrect. ICMP is commonly used for diagnostics and network control, but blocking it does not prevent sniffers from capturing HTTP credentials or session cookies. Packet sniffing tools capture traffic based on network access, interface mode, and traffic visibility; they do not rely on ICMP to read unencrypted application-layer data.