quiz 2

txt

School

New York University *

*We aren’t endorsed by this school

Course

9343

Subject

Computer Science

Date

Jan 9, 2024

Type

txt

Pages

Uploaded by CoachPower7127

1. **After installing Wireshark and initiating packet capture, what protocol will help you determine the IP address associated with a domain name like `[X].neverssl.com`?** A. TCP B. UDP C. DNS D. HTTP **Answer**: C. DNS 2. **Upon visiting a new website, which of the following processes occur first?** A. TCP Handshake B. Data Transfer C. DNS Resolution D. TLS Handshake **Answer**: C. DNS Resolution 3. **How many steps are typically involved in a complete TCP handshake?** A. 1 B. 2 C. 3 D. 4 **Answer**: C. 3 --- ### Task 2: Parsing existing pcap files 4. **Which protocol can help identify the MAC address of a host?** A. ARP B. TCP C. DNS D. ICMP **Answer**: A. ARP 5. **If you see an HTTP request to `http://345678.neverssl.com` in a pcap file, which port is most likely being used for this request?** **Answer**: 80 6. **In the context of networking, what does 'pcap' stand for?** A. Packet Capture B. Protocol Capture C. Port Capture Device D. Packet Control Access Protocol **Answer**: A. Packet Capture ---

### Task 3: Setting up SEED labs 7. **Which of the following is NOT a benefit of using DigitalOcean for setting up SEED labs?** A. Predictable cost B. Faster performance compared to all personal computers C. Easier setup process D. Familiarity of the instructors with the platform **Answer**: B. Faster performance compared to all personal computers --- ### Task 4: Prepare the network environment. 8. **Which command can be used to view the ARP table in Linux?** A. show arp B. arp -a C. display arp D. arp -n **Answer**: D. arp -n 9. **What is the primary purpose of ARP in networking?** A. Resolve domain names to IP addresses B. Establish secure connections C. Resolve IP addresses to MAC addresses D. Monitor network traffic **Answer**: C. Resolve IP addresses to MAC addresses --- ### Task 5: Intercept A’s packets from M. 10. **In the context of ARP spoofing, what does an attacker aim to do?** A. Capture all data on the network B. Send fake ARP responses to redirect traffic through them C. Establish a secure connection with the target D. Resolve IP addresses to MAC addresses **Answer**: B. Send fake ARP responses to redirect traffic through them --- ### Task 6: Implement ARP spoofing in Python 11. **The `scapy` Python package is primarily used for:** A. Web scraping B. Data analysis C. Network packet manipulation D. Establishing secure connections **Answer**: C. Network packet manipulation

### Task 1: Capturing packets on your own 12. **If you visit `https://[X].neverssl.com` instead of `http://[X].neverssl.com`, which protocol will ensure that the communication between the browser and the server is encrypted?** A. TCP B. UDP C. HTTP D. HTTPS **Answer**: D. HTTPS 13. **Which Wireshark filter can be applied to view only DNS traffic?** **Answer**: dns --- ### Task 2: Parsing existing pcap files 14. **If a packet in the pcap file shows a destination port of 53, which protocol is most likely being used?** A. FTP B. SSH C. DNS D. HTTP **Answer**: C. DNS 15. **In a packet capture, seeing a lot of duplicate ACKs may indicate what kind of network issue?** A. A fast network connection B. Packet loss or out-of-order packets C. Successful data transfer D. DNS resolution **Answer**: B. Packet loss or out-of-order packets --- ### Task 3: Setting up SEED labs 16. **Which virtualization software is not recommended for macOS with the M1 chip based on the lab instructions?** A. DigitalOcean B. VirtualBox C. UTM D. AWS **Answer**: B. VirtualBox ---

Your preview ends here

Eager to read complete document? Join bartleby learn and gain access to the full version

Access to all documents
Unlimited textbook solutions
24/7 expert homework help

### Task 4: Prepare the network environment. 17. **If Host A pings Host B continuously and you observe the ICMP protocol in Wireshark, which message type indicates that Host B is replying to Host A's ping?** A. ICMP Request B. ICMP Reply C. ICMP Echo D. ICMP Echo Reply **Answer**: D. ICMP Echo Reply --- ### Task 5: Intercept A’s packets from M. 18. **ARP spoofing primarily exploits which layer of the OSI model?** A. Application B. Transport C. Network D. Data Link **Answer**: D. Data Link --- ### Task 6: Implement ARP spoofing in Python 19. **In ARP spoofing, which field of the ARP packet is maliciously modified by the attacker to redirect traffic?** A. Sender's MAC address B. Sender's IP address C. Target's MAC address D. Target's IP address **Answer**: A. Sender's MAC address 20. **Which Python package allows for real-time capture and interpretation of packets?** A. numpy B. requests C. scapy D. pandas **Answer**: C. scapy Absolutely! Here's an expanded list of questions for each task: --- ### Task 1: Capturing packets on your own 1. **Which tool did you use to capture the network packets?** A. Tcpdump B. Nmap

C. Wireshark D. Netstat **Answer**: C. Wireshark 2. **Upon visiting a website, which protocol is primarily used to resolve the domain name to an IP address?** **Answer**: DNS 3. **Which protocol operates at Layer 4 (Transport Layer) of the OSI model and is connection-oriented?** **Answer**: TCP 4. **What is the default port for HTTP traffic?** **Answer**: 80 5. **Which of the following is NOT an HTTP request method?** A. GET B. POST C. SEND D. PUT **Answer**: C. SEND 6. **In Wireshark, which column displays the high-level protocol type of a packet? ** **Answer**: Protocol 7. **Which status code indicates that the HTTP request has succeeded?** **Answer**: 200 OK 8. **What is the primary purpose of the neverssl.com website?** **Answer**: To force a non-SSL (HTTP) request. 9. **When analyzing packets in Wireshark, which pane provides a detailed breakdown of the selected packet?** **Answer**: The middle pane (Packet Details) 10. **Which protocol ensures secure transmission of data over a network, often represented by a padlock icon in browsers?** **Answer**: HTTPS or SSL/TLS --- ### Task 2: Parsing existing pcap files 11. **What is the file extension for Wireshark capture files?** **Answer**: .pcap

12. **In Wireshark, what is the purpose of the "Apply a Display Filter" field?** **Answer**: To filter the displayed packets based on criteria. 13. **Which of the following cannot be directly determined using a pcap file?** A. IP Address of sender B. Content of transmitted data C. Password of the sender (unless it's sent in plaintext) D. Protocol used for transmission **Answer**: C. Password of the sender (unless it's sent in plaintext) 14. **Which of the following is a potential risk when analyzing pcap files from unknown sources?** **Answer**: Malware or malicious injections 15. **If you see a three-way handshake in a pcap file, which protocol is being used?** **Answer**: TCP 16. **Which of the following best describes a "SYN flood"?** **Answer**: A type of DoS attack that sends a succession of SYN requests. 17. **What protocol uses port 443 by default?** **Answer**: HTTPS 18. **Which flag in a TCP packet indicates the termination of a connection?** **Answer**: FIN 19. **In a TCP connection, if a client sends a packet with the SYN flag set, what flag is expected in the server's response for a successful connection?** **Answer**: SYN, ACK 20. **What Wireshark filter would you use to display only DNS traffic?** **Answer**: dns Certainly! Here are questions for the remaining tasks: --- ### Task 3: Setting up SEED labs 21. **Which of the following platforms can be used to set up SEED labs?** A. AWS B. Azure C. DigitalOcean D. GCP **Answer**: C. DigitalOcean

Your preview ends here

Eager to read complete document? Join bartleby learn and gain access to the full version

Access to all documents
Unlimited textbook solutions
24/7 expert homework help

22. **Why is using a virtual environment like SEED labs advantageous for security testing?** **Answer**: It provides an isolated environment, preventing unintended impacts on production or other systems. 23. **What is the primary purpose of the `su` command in Linux?** **Answer**: To switch to another user account, often the superuser. 24. **Which virtualization software can be used to create SEED labs on a personal computer?** **Answer**: VirtualBox 25. **Why might using cloud-based SEED labs be preferable to local labs for some users?** **Answer**: Cloud labs can offer scalability, accessibility from anywhere, and don't rely on the performance of the user's personal machine. 26. **What is GitHub primarily used for?** **Answer**: Version control and source code management. 27. **Which command provides superuser privileges in Linux?** **Answer**: sudo 28. **In the context of Linux, what does "seed" often refer to in SEED labs?** **Answer**: A user or an environment name. 29. **Which of the following is NOT a virtualization software?** A. VMware B. Hyper-V C. VirtualBox D. FileZilla **Answer**: D. FileZilla 30. **Why might a student be eligible for free DigitalOcean credits through GitHub? ** **Answer**: GitHub offers a student developer pack with various benefits, including cloud credits. --- ### Task 4: Prepare the network environment 31. **What command is used to list the IP addresses of containers in the SEED lab environment?** **Answer**: dockps 32. **Which command is used to access a container's shell in the SEED lab

environment?** **Answer**: docksh 33. **What command in Linux can be used to display the ARP table?** **Answer**: arp -n 34. **What protocol is used by the `ping` command?** **Answer**: ICMP 35. **Which of the following describes ARP?** **Answer**: A protocol used to map 32-bit IP addresses to MAC addresses. 36. **What might an attacker achieve by observing ARP tables in a network?** **Answer**: Information about devices on the network, potentially aiding in Man- in-the-Middle attacks. 37. **Why is ARP poisoning or spoofing a security concern?** **Answer**: It allows an attacker to intercept data frames on a network. 38. **Which command is used to display network interfaces and their status in Linux?** **Answer**: ifconfig or ip a 39. **In the context of networking, what does "M" often stand for in lab environments like SEED labs?** **Answer**: A machine or a host on the network. 40. **What is the primary function of the Address Resolution Protocol (ARP)?** **Answer**: To translate IP addresses into MAC addresses. --- ### Task 5: Intercept A’s packets from M 41. **What Linux tool is commonly used for ARP spoofing?** **Answer**: arpspoof 42. **What is the potential impact of ARP spoofing on a target network?** **Answer**: Data interception, session hijacking, and denial of service. 43. **In Wireshark, how can you filter to see only HTTP GET requests?** **Answer**: http.request.method == "GET" 44. **What is a common countermeasure against ARP spoofing?** **Answer**: Static ARP tables or ARP spoofing detection tools.

45. **Why is it possible for M to view the content of A's communication with B in this task?** **Answer**: Because the communication is not encrypted. --- ### Task 6: Implement ARP spoofing in Python 46. **Which Python library can be used to craft and send packets?** **Answer**: scapy 47. **Why is it important to handle exceptions when writing network tools in Python?** **Answer**: To handle unexpected errors gracefully, like network timeouts or unreachable hosts. 48. **What is the main difference between using `arpspoof` and creating your own ARP spoofing tool in Python?** **Answer**: Customization and understanding of underlying principles. 49. **How can you prevent your ARP spoofing Python script from sending packets too quickly and flooding the network?** **Answer**: Introduce a delay or sleep between sending packets. 50. **Why might you want to implement ARP spoofing in Python rather than using existing tools?** **Answer**: For educational purposes, to understand the underlying process, or to create customized features. **1. What software is used to capture packets in Task 1?** - A) tcpdump - B) Netstat - C) Wireshark - D) Pcap - **Answer: C) Wireshark** **2. What does the website 'neverssl.com' typically help with?** - A) Encrypting traffic. - B) Blocking SSL traffic. - C) Forcing a device to fetch a non-SSL page. - D) Providing SSL certificates. - **Answer: C) Forcing a device to fetch a non-SSL page.** **3. In a DNS response, where can the IP addresses associated with a domain be found?** - A) Questions section - B) Authority section - C) Additional section - D) Answers section - **Answer: D) Answers section**

Your preview ends here

Eager to read complete document? Join bartleby learn and gain access to the full version

Access to all documents
Unlimited textbook solutions
24/7 expert homework help

**4. Which protocol is responsible for resolving domain names to IP addresses?** - A) DHCP - B) ARP - C) DNS - D) ICMP - **Answer: C) DNS** **5. Which type of DNS record contains IP addresses?** - A) MX - B) CNAME - C) A - D) NS - **Answer: C) A** **6. Can your ISP see HTTPS requests?** - A) Yes, including the data. - B) Yes, but only the destination, not the data. - C) No, it's encrypted. - D) Only if they have the SSL certificate. - **Answer: B) Yes, but only the destination, not the data.** **7. How does the ARP protocol help in local networks?** - A) It resolves domain names to IP addresses. - B) It determines the MAC address associated with a given IP address. - C) It encrypts network traffic. - D) It routes packets between networks. - **Answer: B) It determines the MAC address associated with a given IP address.** **8. What's a primary purpose of the SEED lab environment?** - A) Web hosting. - B) DNS server simulation. - C) Network vulnerability testing. - D) Large-scale data analysis. - **Answer: C) Network vulnerability testing.** **9. In the context of ARP spoofing, what does the attacker try to do?** - A) Decrypt SSL traffic. - B) Impersonate another host in the network. - C) Flood the network with ARP requests. - D) Disconnect the host from the network. - **Answer: B) Impersonate another host in the network.** **10. What programming language is suggested for implementing the ARP spoofing tool in Task 6?** - A) Java - B) C++ - C) Python - D) Ruby - **Answer: C) Python** **11. When the `arpspoof` command is used, what does it primarily target?** - A) TCP handshake - B) ARP table entries - C) DNS resolution - D) ICMP requests - **Answer: B) ARP table entries** **12. What tool/command allows you to view packet payloads from the terminal?** - A) arp

- B) netstat - C) ping - D) tcpdump - **Answer: D) tcpdump** **13. What can be deduced if you see duplicated packet contents when observing traffic?** - A) The network is slow. - B) There's a loop in the network. - C) Packet injection or spoofing might be occurring. - D) The firewall is blocking packets. - **Answer: C) Packet injection or spoofing might be occurring.** **14. What package is recommended for ARP spoofing implementation in Python?** - A) requests - B) socket - C) scapy - D) os - **Answer: C) scapy** **15. Which command shows the ARP table on a Linux system?** - A) arp -n - B) arp -a - C) arp -l - D) show arp - **Answer: A) arp -n** **16. In Task 3, which platform is suggested for setting up the SEED lab environment?** - A) AWS - B) DigitalOcean - C) Azure - D) Heroku - **Answer: B) DigitalOcean** **17. Why would one choose to visit a site like `[X].neverssl.com`?** - A) To download SSL certificates. - B) To force a device to make a non-SSL request. - C) To test a website's security. - D) To make an anonymous request. - **Answer: B) To force a device to make a non-SSL request.** **18. Which command is used to access the shell of a particular host in the lab setup?** - A) docker exec - B) docker shell - C) docksh - D) docker attach - **Answer: C) docksh** **19. Why might you observe traffic from Host M even if it's not directly communicating with another host?** - A) Because of a broadcast request. - B) Due to a man-in-the-middle attack. - C) Because of a DNS resolution error. - D) Due to an error in the routing table. - **Answer: B) Due to a man-in-the-middle attack.** **20. How can you confirm that Host A's packets are being intercepted by Host M?**

- A) By checking the encryption status of A's packets. - B) By observing duplicated or similar packets on M. - C) By inspecting the router logs. - D) By sending a confirmation request from A to M. - **Answer: B) By observing duplicated or similar packets on M.** **21. Which command serves files over HTTP using Python?** - A) python -m server.http - B) python -m http.serve - C) python3 -m http.server - D) python3 -m serve.http - **Answer: C) python3 -m http.server** **22. If Bob is trying to visit `http://345678.neverssl.com`, and we see packets in the pcap file for this request, what type of packets are we most likely observing? ** - A) ICMP - B) ARP - C) HTTP - D) SSL/TLS - **Answer: C) HTTP** **23. When using `arpspoof`, what is the attacker primarily trying to become?** - A) The default gateway - B) The primary DNS resolver - C) The router - D) The main switch - **Answer: A) The default gateway** **24. In an ARP spoofing attack, which table in the victim's computer gets altered? ** - A) Routing table - B) DNS cache - C) NAT table - D) ARP cache/table - **Answer: D) ARP cache/table** **25. What does a successful ARP spoofing attack allow the attacker to do?** - A) Decrypt HTTPS traffic. - B) Monitor and possibly modify traffic between two parties. - C) Increase network bandwidth. - D) Assign IP addresses in the network. - **Answer: B) Monitor and possibly modify traffic between two parties.** **26. Which protocol operates at the Data Link layer of the OSI model?** - A) DNS - B) ARP - C) TCP - D) HTTP - **Answer: B) ARP** **27. What packet data can be monitored during an ARP spoofing attack?** - A) Only data sent by the attacker. - B) Only HTTPS traffic. - C) Traffic between two devices that the attacker is spoofing. - D) All traffic in the network. - **Answer: C) Traffic between two devices that the attacker is spoofing.**

Your preview ends here

Eager to read complete document? Join bartleby learn and gain access to the full version

Access to all documents
Unlimited textbook solutions
24/7 expert homework help

**28. If someone is running the `arpspoof` tool between Host A and Host B, who would believe they are communicating with the real counterpart?** - A) Only Host A - B) Only Host B - C) Both Host A and Host B - D) Neither Host A nor Host B - **Answer: C) Both Host A and Host B** **29. What is the primary security measure to prevent ARP spoofing?** - A) SSL/TLS encryption. - B) Two-factor authentication. - C) Static ARP entries. - D) Using a VPN. - **Answer: C) Static ARP entries.** **30. In the SEED lab setup, what is a main purpose of using Docker containers?** - A) Data storage. - B) Website hosting. - C) Isolated, reproducible environment for testing. - D) Speeding up internet connections. - **Answer: C) Isolated, reproducible environment for testing.** **31. Why is ARP spoofing difficult to detect?** - A) It always encrypts its traffic. - B) It operates on a layer that is rarely logged. - C) It relies on user input for execution. - D) It quickly crashes the network, leaving no trace. - **Answer: B) It operates on a layer that is rarely logged.** **32. What is a potential consequence of ARP spoofing on a network?** - A) Reduced network speed. - B) Hosts receiving IP conflict errors. - C) A host being unable to access the internet. - D) Exposure or alteration of transmitted data. - **Answer: D) Exposure or alteration of transmitted data.** **33. Why would an attacker want to capture DNS queries?** - A) To discover websites a user is visiting. - B) To increase their bandwidth. - C) To get the MAC address of devices. - D) To get the encryption keys of HTTPS sites. - **Answer: A) To discover websites a user is visiting.** **34. When a DNS query is made, which type of record typically indicates a mail server?** - A) A - B) MX - C) CNAME - D) NS - **Answer: B) MX** **35. What does 'Man-in-the-Middle' (MitM) primarily refer to?** - A) An attacker situated between two communicating hosts. - B) A tool used for packet sniffing. - C) A type of virus. - D) A firewall setting. - **Answer: A) An attacker situated between two communicating hosts.**

**36. How is the packet-forwarding feature enabled in Linux systems?** - A) Using the `arpspoof` tool. - B) Modifying the ARP table. - C) Setting `ip_forward` to 1 in procfs. - D) Through the network manager settings. - **Answer: C) Setting `ip_forward` to 1 in procfs.** **37. If an attacker successfully performs ARP spoofing between a host and its gateway, which traffic can they potentially capture?** - A) Only the traffic sent from the host. - B) Only the traffic sent to the host. - C) Both the traffic sent from and received by the host. - D) None of the above. - **Answer: C) Both the traffic sent from and received by the host.** **38. What is the purpose of the SEED lab 'ARP Cache Poisoning Attack Lab'?** - A) To test ARP vulnerabilities in new software. - B) To teach students about ARP and its vulnerabilities. - C) To develop patches for ARP attacks. - D) To simulate a real-world ARP-based attack on a company. - **Answer: B) To teach students about ARP and its vulnerabilities.** **39. What does the `-r` flag in the `tcpdump` command do?** - A) Resets the interface. - B) Repeats the capture. - C) Reads packets from a file. - D) Resolves domain names. - **Answer: C) Reads packets from a file.** **40. In an ARP request, what is the sender asking for?** - A) An IP address. - B) A MAC address. - C) A domain name. - D) An SSL certificate. - **Answer: B) A MAC address.** **41. Which tool can be used to inspect and analyze network packets graphically?** - A) tcpdump - B) arpwatch - C) Wireshark - D) netstat - **Answer: C) Wireshark** **42. When two hosts communicate over HTTPS, can an attacker performing ARP spoofing decrypt their traffic without additional means?** - A) Yes, always. - B) No, HTTPS encrypts the data. - C) Only if they have the private SSL certificate. - D) Only if the traffic is not properly encrypted. - **Answer: B) No, HTTPS encrypts the data.** **43. In the lab environment, how many Docker containers are typically set up?** - A) 1 - B) 2 - C) 3 - D) 4 - **Answer: C) 3** **44. Which Docker command is used to list all running containers?**

- A) docker ps - B) docker list - C) docker show - D) docker run - **Answer: A) docker ps** **45. What is the significance of the 'ttl' value in an IP packet?** - A) It indicates the packet's speed. - B) It determines the encryption level. - C) It represents how many routers the packet can pass through before being discarded. - D) It signifies the packet's priority. - **Answer: C) It represents how many routers the packet can pass through before being discarded.** **46. What does a TTL value of 1 in an IP packet typically indicate?** - A) The packet is given top priority. - B) The packet is intended for the immediate next hop. - C) The packet has traveled across the globe. - D) The packet is encrypted. - **Answer: B) The packet is intended for the immediate next hop.** **47. In the context of ARP, what is 'poisoning'?** - A) Injecting malware into a network. - B) Forcing a network disconnect. - C) Introducing false ARP responses to mislead hosts. - D) Decreasing the network bandwidth. - **Answer: C) Introducing false ARP responses to mislead hosts.** **48. What is the primary goal of DNSSEC?** - A) Speeding up DNS queries. - B) Encrypting DNS traffic. - C) Authenticating DNS response data. - D) Compressing DNS data. - **Answer: C) Authenticating DNS response data.** **49. What command-line tool can be used to query DNS records?** - A) traceroute - B) dig - C) arp - D) ifconfig - **Answer: B) dig** **50. What is the purpose of a MAC address in a network?** - A) Identify the location of a device globally. - B) Encrypt network traffic. - C) Uniquely identify a device on a local network. - D) Assign IP addresses dynamically. - **Answer: C) Uniquely identify a device on a local network.** Certainly! If you've captured packets from a visit to `neverssl.com` using Wireshark, here are 10 potential multiple-choice questions that could be asked: 1. **Which protocol was primarily used to access neverssl.com?**

Your preview ends here

Eager to read complete document? Join bartleby learn and gain access to the full version

Access to all documents
Unlimited textbook solutions
24/7 expert homework help

- a) ICMP - b) FTP - c) HTTP - d) SMTP Answer: - c) HTTP 2. **What status code might you expect to see in the HTTP response when accessing a valid webpage?** - a) 200 OK - b) 404 Not Found - c) 500 Internal Server Error - d) 403 Forbidden Answer: - a) 200 OK 3. **Which of the following layers in the OSI model would be directly responsible for resolving the IP address of neverssl.com?** - a) Presentation Layer - b) Application Layer - c) Network Layer - d) Transport Layer Answer: - c) Network Layer 4. **What was the destination port when trying to access neverssl.com on a standard non-secure connection?** - a) 22 - b) 80 - c) 443 - d) 21 Answer: B) 80 5. **Which type of packet is used to establish a connection between your computer and neverssl.com?** - a) UDP - b) ARP - c) ICMP Echo Request - d) TCP SYN Answer: - d) TCP SYN 6. **Which of the following fields would you NOT expect to see in the Ethernet frame header?** - a) Source MAC Address - b) Destination MAC Address - c) TTL (Time to Live) - d) Frame Type Answer: - c) TTL (Time to Live) 7. **If the packets to neverssl.com are encrypted, which protocol might be in use? ** - a) HTTP - b) FTP - c) HTTPS - d) Telnet Answer: - c) HTTPS 8. **Which HTTP method is typically used when requesting a webpage from neverssl.com?** - a) POST

- b) GET - c) PUT - d) DELETE Answer: - b) GET 9. **In the TCP handshake process, what follows the initial SYN packet?** - a) SYN-ACK - b) ACK - c) FIN - d) RST Answer: - a) SYN-ACK 10. **Which of the following headers might be present in an HTTP request to neverssl.com to tell the server the type of browser you are using?** - a) Content-Type - b) Content-Length - c) User-Agent - d) If-Modified-Since Answer: - c) User-Agent

quiz 2

Related Documents