Network Attacks and Defense Strategies
Organize attacks by phase and objective
A candidate should be able to place any attack in two dimensions: the phase of the intrusion (reconnaissance, scanning/enumeration, exploitation, privilege escalation, lateral movement, persistence, exfiltration) and the security objective it violates (confidentiality, integrity, availability). Reconnaissance splits into passive (OSINT, whois, DNS lookups, sniffing) and active (port scanning, banner grabbing, enumeration). Access attacks break authentication: brute force, password spraying, credential stuffing, pass-the-hash, session hijacking. Availability attacks are DoS (single source) versus DDoS (distributed), grouped as volumetric (UDP/ICMP floods, DNS amplification), state-exhaustion/protocol (SYN flood, teardrop fragmentation overlap, smurf), and application-layer (HTTP flood, Slowloris). Interception covers on-path/MITM, ARP poisoning, rogue DHCP, and DNS spoofing.
Defense strategy
Defense in depth stacks preventive, detective, and corrective controls; segmentation limits blast radius; least privilege and hardening shrink the attack surface; continuous monitoring shortens dwell time.
Traps
Questions blur DoS with DDoS, or name an attack by effect rather than mechanism. Know that a SYN flood leaves half-open connections, smurf uses ICMP echo to a broadcast address with a spoofed source, MAC flooding overflows the switch CAM table while ARP poisoning impersonates the gateway, and Slowloris is application-layer, not network-layer. Also distinguish spoofing (falsifying identity) from hijacking (taking over an established session).
Rule of thumb
When a stem describes a symptom, ask: which objective is targeted, and is the source single or distributed? Those two answers usually eliminate every distractor.