312-50 Question 272
Single answer▪ Evading NAC and Endpoint SecurityDuring an authorized internal assessment, a tester plugs a laptop into an unused office network port. The switch places the device into a remediation VLAN because the endpoint does not meet Network Access Control (NAC) posture requirements. The tester notices that a recently disconnected corporate workstation at the same desk had full network access. Which technique would most likely allow the tester to bypass NAC and gain the same level of access without exploiting the NAC server itself?
- A
Clone the corporate workstation's MAC address and, if required by the NAC design, reuse its IP configuration after ensuring the original host is offline
- B
Perform ARP spoofing against the default gateway so the NAC appliance cannot see posture traffic
- C
Send crafted ICMP redirect messages to move the laptop out of the remediation VLAN
- D
Launch a DNS cache poisoning attack to make the NAC agent contact a fake posture server
Show answer and explanation
Correct answer: A
Explanation
The most realistic answer is cloning the authorized workstation's MAC address, because NAC deployments that depend on MAC Authentication Bypass, profiling, or cached access state can sometimes be evaded by impersonating a previously approved endpoint. In real environments, this is especially relevant when an attacker or tester connects to the same physical port after a legitimate device is removed. By contrast, ARP spoofing, ICMP redirects, and DNS poisoning are network manipulation techniques, but they do not usually alter NAC authorization state on the switch. Best practice guidance from major NAC vendors and 802.1X deployment recommendations emphasizes that MAC-based identity is weaker than certificate-based EAP-TLS authentication, and that relying on MAB alone can permit device impersonation. From a defensive perspective, organizations should prefer strong 802.1X methods, enable reauthentication, use endpoint certificates, bind access decisions to authenticated supplicants rather than just MAC addresses, and monitor for duplicate MAC events on switching infrastructure.
- A. Correct.
Correct. In environments where NAC enforcement is tied primarily to switch port state, MAC authentication bypass (MAB), or cached endpoint identity, cloning the previously authorized endpoint's MAC address can allow a tester to inherit that device's access profile. Reusing the prior IP configuration may also be necessary in some networks, but only after verifying the legitimate workstation is disconnected to avoid an IP or MAC conflict. This reflects a practical NAC evasion technique seen in assessments when NAC relies more on endpoint identity at Layer 2 than on strong, continuous posture validation.
- B. Incorrect.
Incorrect. ARP spoofing can interfere with local traffic and potentially enable man-in-the-middle attacks, but it does not normally cause a NAC solution to reclassify an endpoint from a remediation VLAN to a production VLAN. NAC decisions are typically made through 802.1X, MAB, posture assessment, or switch policy enforcement rather than by observing ordinary ARP behavior.
- C. Incorrect.
Incorrect. ICMP redirects may influence host routing behavior under limited conditions, but they do not instruct enterprise switches or NAC platforms to change VLAN assignments. VLAN placement is controlled by the switch and NAC policy, not by host-level route updates. This option reflects a misunderstanding of the difference between routing manipulation and access control enforcement.
- D. Incorrect.
Incorrect. DNS cache poisoning targets name resolution, but NAC posture agents and enforcement systems do not typically grant production access merely because a client resolves a posture server name differently. In many deployments, the switch enforces the restricted VLAN before posture communication even matters, and modern NAC agents commonly use authenticated or pinned communication mechanisms that would not be bypassed this way.