INT244 Unit 4: Sniffers, Social Engineering, Denial of Service - MCQ Practice | B. Tech. CSE

1 $What is the primary function of a packet sniffer in a network environment?$

A.

To capture and analyze network traffic

B.

To flood the network with data

C.

To encrypt network traffic

D.

To block unauthorized access

2 $In which mode must a Network Interface Card (NIC) be configured to capture all packets on a network segment, regardless of the destination MAC address?$

A.

Safe Mode

B.

Private Mode

C.

Protected Mode

D.

Promiscuous Mode

3 $Which of the following best describes 'Passive Sniffing'?$

A.

Sniffing on a switched network by injecting packets

B.

Sniffing on a hub-based network without altering traffic

C.

Using ARP poisoning to redirect traffic

D.

Overloading the switch's CAM table

4 $Why is sniffing on a switched network more difficult than on a hub-based network?$

A.

Switches do not support Promiscuous mode

B.

Switches have built-in firewalls

C.

Switches only forward packets to the specific destination port

D.

Switches encrypt all data by default

5 $What attack technique involves flooding a switch with numerous fake MAC addresses to fill up its CAM table?$

A.

DHCP Starvation

B.

ARP Poisoning

C.

MAC Flooding

D.

DNS Spoofing

6 $What is the result when a switch enters 'fail-open' mode due to a MAC flooding attack?$

A.

It blocks all UDP traffic

B.

It disconnects the attacker

C.

It shuts down all ports

D.

It acts like a hub and broadcasts all traffic

7 $Which protocol is abused during an ARP Poisoning attack?$

A.

Address Resolution Protocol

B.

Advanced Routing Protocol

C.

Automatic Retrieval Protocol

D.

Authenticated Resolution Protocol

8 $ARP Poisoning is commonly used to facilitate which type of attack?$

A.

SQL Injection

B.

Cross-Site Scripting

C.

Buffer Overflow

D.

Man-in-the-Middle (MitM)

9 $What is MAC Spoofing?$

A.

Flooding the network with MAC addresses

B.

Physically replacing a network card

C.

Changing the factory-assigned MAC address of a NIC in software

D.

Stealing a user's password via email

10 $Which switch feature allows an administrator to copy traffic from one port to another for analysis?$

A.

Port Security

B.

Spanning Tree Protocol

C.

VLAN Tagging

D.

SPAN (Switched Port Analyzer)

11 $What is the primary difference between a SPAN port and a hardware network tap?$

A.

SPAN is undetectable; taps are easily detected

B.

Taps drop packets; SPAN guarantees 100% capture

C.

A tap is software-based; SPAN is hardware-based

D.

A tap is a physical device inserted into the cable; SPAN is a switch configuration

12 $Which tool is commonly associated with performing MAC flooding attacks?$

A.

Nessus

B.

macof

C.

Wireshark

D.

Nmap

13 $How can an administrator detect a NIC running in promiscuous mode using DNS?$

A.

The NIC performs reverse DNS lookups for every IP it sniffs

B.

The NIC blocks port 53

C.

The NIC sends broadcast DNS requests only

D.

The NIC will not respond to DNS queries

14 $Which method involves measuring the response time of a host to detect if it is sniffing?$

A.

ARP Method

B.

Etherflood Method

C.

DNS Method

D.

Latency/Ping Method

15 $Which of the following is the most effective defense against packet sniffing?$

A.

Using encryption (e.g., SSH, SSL/TLS)

B.

Hiding the SSID

C.

Using static IP addresses

D.

Using a complex password

16 $What is Social Engineering in the context of information security?$

A.

Hacking into social media servers

B.

Manipulating people into divulging confidential information

C.

Creating social networks for hackers

D.

Engineering secure social platforms

17 $Which is the first phase of a social engineering attack?$

A.

Research/Reconnaissance

B.

Exploit

C.

Develop Relationship

D.

Select Victim

18 $In the context of social engineering phases, what is 'Pretexting' often part of?$

A.

The hook/trust development phase

B.

The hardware installation phase

C.

The cleanup phase

D.

The research phase

19 $Which social engineering threat involves sending fraudulent emails appearing to be from reputable sources?$

A.

Tailgating

B.

Phishing

C.

Dumpster Diving

D.

Vishing

20 $What is 'Vishing'?$

A.

Virtual Phishing

B.

Video Phishing

C.

Visual Phishing

D.

Voice/VoIP Phishing

21 $What is 'Smishing'?$

A.

Social Media Phishing

B.

Small Phishing attacks

C.

Smart Phishing

D.

Phishing via SMS/Text messages

22 $Looking over someone's shoulder to get information such as PINs or passwords is known as:$

A.

Screen Scraping

B.

Eavesdropping

C.

Shoulder Surfing

D.

Piggybacking

23 $Searching through trash to find sensitive information like bills or notes is called:$

A.

Dumpster Diving

B.

Garbage Spoofing

C.

Waste Management

D.

Recycling

24 $An attacker waits for an authorized person to open a secure door and then follows them inside. This is called:$

A.

Lock Picking

B.

Tailgating/Piggybacking

C.

Fence Jumping

D.

Door Jamming

25 $Which attack involves leaving infected physical media (like a USB drive) in a public place hoping someone plugs it in?$

A.

Baiting

B.

Skimming

C.

Phishing

D.

Spamming

26 $What is 'Quid Pro Quo' in social engineering?$

A.

Using a fake website

B.

Stealing an ID card

C.

Threatening a victim

D.

Promising a benefit in exchange for information

27 $Identity theft primarily involves:$

A.

Stealing a physical laptop

B.

Crashing a server

C.

Impersonating someone using their personal information

D.

Deleting a user's files

28 $What is the primary goal of a Denial of Service (DoS) attack?$

A.

To compromise data integrity

B.

To disrupt the availability of a service

C.

To steal data

D.

To gain administrative access

29 $What distinguishes a DDoS attack from a standard DoS attack?$

A.

DDoS is only done via email

B.

DDoS uses multiple compromised systems (botnet)

C.

DDoS targets databases only

D.

DDoS uses a single attacker

30 $In a DDoS architecture, what is a 'Zombie'?$

A.

The firewall

B.

The target server

C.

A compromised computer controlled by the attacker

D.

The attacker's computer

31 $Which attack exploits the TCP three-way handshake by sending many connection requests but never completing them?$

A.

HTTP GET Flood

B.

UDP Flood

C.

SYN Flood

D.

Ping of Death

32 $What is a 'Smurf Attack'?$

A.

Using spoofed broadcast pings to flood a target

B.

Crashing a database with SQL queries

C.

Sending oversized ICMP packets

D.

Sending malware via email

33 $Which of the following is an example of a Permanent Denial of Service (PDoS) attack?$

A.

Teardrop Attack

B.

Phlashing

C.

SYN Flooding

D.

Session Hijacking

34 $What type of DoS attack targets the application layer (Layer 7)?$

A.

SYN Flood

B.

HTTP Flood

C.

UDP Flood

D.

Smurf Attack

35 $Which tool, known as the 'Low Orbit Ion Cannon', is a popular open-source network stress testing and DoS tool?$

A.

Metasploit

B.

Netcat

C.

LOIC

D.

Nmap

36 $What is the function of a Command and Control (C&C) server in a DDoS attack?$

A.

To host the victim website

B.

To filter traffic

C.

To send instructions to the botnet

D.

To generate logs

37 $Which DoS tool is designed to keep many connections to the target web server open and hold them as long as possible?$

A.

Wireshark

B.

John the Ripper

C.

Slowloris

D.

Ping

38 $What is a 'Teardrop' attack?$

A.

Flooding with tear-shaped emojis

B.

Disconnecting the power cable

C.

Sending packets with future timestamps

D.

Sending fragmented packets that cannot be reassembled

39 $Hping3 is a command-line oriented TCP/IP packet assembler/analyzer that can be used for:$

A.

Repairing corrupted files

B.

Social engineering

C.

Generating specific packet floods for DoS

D.

Only passive sniffing

40 $What is a 'Reflection Attack'?$

A.

Spoofing the victim's IP and sending requests to third-party servers

B.

Mirroring the victim's website

C.

Hacking the internal router

D.

Reflecting laser signals

41 $Which of the following is a critical consideration when performing a DoS Pen-Test?$

A.

Coordinate with the ISP and cloud provider

B.

Use the most destructive malware available

C.

Ensure the attack is done without permission

D.

Target the personal devices of employees

42 $What is 'Blackholing' or 'Sinkholing' in the context of DDoS mitigation?$

A.

Hacking back the attacker

B.

Redirecting malicious traffic to a non-existent endpoint

C.

Deleting the attacker's computer

D.

Shutting down the internet

43 $Which UDP-based amplification attack uses Network Time Protocol servers?$

A.

NTP Amplification

B.

SYN Flood

C.

Slowloris

D.

HTTP Flood

44 $What is the concept of 'Reverse Social Engineering'?$

A.

The victim attacks the social engineer

B.

Ignoring social engineering attempts

C.

Using software to block social media

D.

The attacker creates a problem and convinces the victim to contact them for help

45 $Which tool is an advanced version of LOIC that supports HTTP floods and customization?$

A.

HOIC (High Orbit Ion Cannon)

B.

Ping

C.

Traceroute

D.

Netstat

46 $What does a packet sniffer capture when a network uses unencrypted Telnet?$

A.

Only the headers

B.

Encrypted hashes

C.

Plaintext usernames and passwords

D.

Garbage characters

47 $In a Man-in-the-Middle attack enabled by ARP poisoning, the attacker acts as:$

A.

A DNS server

B.

A relay between the victim and the gateway

C.

A database administrator

D.

A firewall

48 $Which of the following describes 'Impersonation' in social engineering?$

A.

Pretending to be a legitimate user or authority figure

B.

Cracking a password

C.

Installing a virus

D.

Scanning ports

49 $What is the 'Ping of Death'?$

A.

Pinging a server every second

B.

A ping that destroys the hardware

C.

Sending an ICMP packet larger than the maximum IP packet size (65,535 bytes)

D.

A ping that carries a virus

50 $Which countermeasure helps prevent ARP Poisoning on a switch?$

A.

Dynamic ARP Inspection (DAI)

B.

Disabling all ports

C.

Turning off the power

D.

Using Hubs instead of Switches

Unit 4: Sniffers, Social Engineering, Denial of Service - Practice Quiz

Did this save you a night before the exam?