312-50 Question 270
Single answer▪ Evading NAC and Endpoint SecurityDuring an authorized internal penetration test, you connect a laptop to an unused office Ethernet port. The port remains in a restricted VLAN with no access to production systems. Packet captures show the switch is using 802.1X for access control and falls back to MAC Authentication Bypass (MAB) for devices that do not complete 802.1X. You also observe that a deployed corporate IP phone successfully authenticates on the same switch model and then allows a workstation to connect through its built-in PC port. Which action would be the most appropriate CEH-style technique to test whether the NAC policy can be bypassed without exploiting the switch itself?
- A
Clone the MAC address of the authorized IP phone and connect directly to the wall port to see whether MAB allows the endpoint onto the production VLAN
- B
Launch a DHCP starvation attack so the NAC server cannot assign a restricted address, forcing the switch to grant normal access
- C
Send forged STP BPDUs to make the switch disable 802.1X and revert the port to an open state
- D
Perform ARP spoofing against the default gateway to intercept EAPOL frames and replay the phone's credentials
Show answer and explanation
Correct answer: A
Explanation
This question focuses on a practical NAC-evasion scenario common in enterprise environments: 802.1X with MAB fallback. A key real-world weakness is that MAB authenticates based on a device MAC address, which is not a strong identity factor because MAC addresses can be spoofed. In an authorized assessment, cloning the MAC address of a device type known to be allowed, such as a VoIP phone, is a legitimate way to test whether the NAC policy improperly grants access based on MAC alone or misclassifies the endpoint into a voice or trusted VLAN. By contrast, DHCP starvation, STP manipulation, and ARP spoofing do not directly test the NAC policy described. This aligns with how 802.1X and MAB are documented by major network vendors: 802.1X controls port-based access, while MAB is a fallback mechanism for non-802.1X-capable devices and is weaker because it relies on MAC identity. Best practice is to use certificate-based 802.1X where possible, tightly constrain MAB, profile devices carefully, and apply authorization policies that limit access for MAB-authenticated endpoints.
- A. Correct.
Correct. In environments that rely on MAB as a fallback, the switch may authorize access based only on a known device MAC address if 802.1X is not completed. Testing whether cloning the MAC address of an already authorized device results in broader network access is a realistic NAC-evasion assessment step, provided it is explicitly within scope and coordinated to avoid disrupting the legitimate device. This directly evaluates a common weakness in NAC deployments: trusting MAC identity alone.
- B. Incorrect.
Incorrect. DHCP starvation targets address allocation, not NAC decision-making. 802.1X and MAB authorization occur at the switch access-control layer before normal network access is granted. Exhausting DHCP leases does not cause a compliant NAC-enabled switch to bypass authentication and place a device into a production VLAN.
- C. Incorrect.
Incorrect. Forging STP BPDUs is not an appropriate or reliable way to make a switch disable 802.1X. In practice, BPDU-related behavior is controlled by spanning-tree protections such as BPDU Guard or Root Guard, and malicious BPDUs are more likely to trigger protective actions or disrupt connectivity than to bypass NAC. This confuses Layer 2 topology manipulation with NAC authentication logic.
- D. Incorrect.
Incorrect. EAPOL frames used in 802.1X authentication are exchanged locally between the supplicant and authenticator on the LAN segment; ARP spoofing the gateway does not place the attacker in that path. In addition, replaying 802.1X credentials is generally not straightforward because EAP methods commonly use challenge-response exchanges, certificates, or protected tunnels rather than static reusable credentials visible to simple interception.