Google News
Ethical Hacking Interview Questions
A network protocol is established as a set of rules to determine the way data transmissions take place between the devices in the same network. It basically allows communication between the connected devices regardless of any differences in their internal structure, design, or processes. Network protocols play a critical role in digital communications.
ARP (Address Resolution Protocol) is a form of attack in which an attacker changes MAC ( Media Access Control) address and attacks an internet LAN by changing the target computer’s ARP cache with a forged ARP request and reply packets.
ARP poisoning can be prevented by following methods
Packet Filtering : Packet filters are capable for filtering out and blocking packets with conflicting source address information

Avoid trust relationship : Organization should develop protocol that rely on trust relationship as little as possible

Use ARP spoofing detection software : There are programs that inspects and certifies data before it is transmitted and blocks data that is spoofed

Use cryptographic network protocols : By using secure communications protocols like TLS, SSH, HTTP secure prevents ARP spoofing attack by encrypting data prior to transmission and authenticating data when it is received
Mac Flooding is a technique where the security of given network switch is compromised. In Mac flooding the hacker or attacker floods the switch with large number of frames, then what a switch can handle. This make switch behaving as a hub and transmits all packets at all the ports. Taking the advantage of this the attacker will try to send his packet inside the network to steal the sensitive information.
A Rogue DHCP server is DHCP server on a network which is not under the control of administration of network staff. Rogue DHCP Server can be a router or modem. It will offer users IP addresses , default gateway, WINS servers as soon as user’s logged in. Rogue server can sniff into all the traffic sent by client to all other networks.
Data leak is nothing but data knowledge getting out of the organization in an unauthorized manner. Data will get leaked through numerous ways in which – emails, prints, laptops obtaining lost, unauthorized transfer of data to public portals, removable drives, pictures, etc. Security of data is very important nowadays so there are varied controls that may be placed to make sure that the info doesn’t get leaked, many controls will be limiting upload on web websites, following an internal encryption answer, limiting the emails to the interior network, restriction on printing confidential data etc.
Sniffing in Ethical Hacking is a method implemented for monitoring all the data packets that pass through a particular network. Sniffers are primarily used to oversee and troubleshoot network traffic, and Network/System Administrators are responsible for this role. Sniffers can be installed in the system in the form of software or hardware.
However, attackers can misuse sniffers to gain access to data packets that contain sensitive information, such as account information, passwords, etc. Packet sniffers on a network can give a malicious hacker the opportunity to intrude and access all of the network traffic.
There are two types of sniffing :
Active sniffing : Sniffing in a point-to-point network device called the switch is referred to as active sniffing. The switch is responsible for the regulation of the data flow between its ports. This is done through the active monitoring of the MAC address on each port, which enables the passing of data only to the intended target. To activate the sniffing of the traffic between targets, sniffers have to inject traffic into the LAN. 

Passive sniffing : Passive sniffing happens when the sniffing is done through the hub. The traffic that goes through the unbridged network or the non-switched segment is transparent to all machines in that segment. Here, sniffers work at the network’s data link layer. This is called passive sniffing as sniffers set up by the attackers passively wait for the data to capture them when they are sent.
Keylogger Trojan is malicious software that can monitor your keystroke, logging them to a file and sending them off to remote attackers. When the desired behaviour is observed, it will record the keystroke and captures your login username and password.
An intrusion detection system, or IDS for short, is a software application or device that monitors a network for the detection of malicious activities or policy violations. Any detected malicious activity or violation is reported or collected centrally with the help of a security information and event management system. An IDS that can respond to intrusions upon discovery is classified as an intrusion prevention system (IPS).
A security operations center (SOC) as a facility houses the information security team. This team is set in place to continuously monitor and analyze an organization’s security. The SOC team’s responsibility includes detection, analysis, and immediate response to Cybersecurity incidents through the implementation of various technology solutions and a set of processes. The team may include Security Analysts, Engineers, and Managers who work closely with the incident response team.