Exam CS0-002 topic 1 question 228 discussion

The penetration tester, by placing the network adapter in promiscuous mode and logging traffic for later analysis, is performing: C. Protocol analysis In this scenario, the tester is not actively scanning for credentials, which would involve attempting to gather usernames and passwords. Instead, the focus is on monitoring and analyzing network traffic passively. This aligns more closely with the concept of protocol analysis, where the tester observes and analyzes the protocols and traffic on the network without actively interacting or attempting to manipulate it.

It makes more sense when it reads: "A penetration tester physically enters a datacenter and attaches a small device to a switch. As part of the tester's effort to evaluate which nodes are present on the network; the tester places the network adapter in promiscuous mode and logs traffic for later analysis. Which of the following is the tester performing?"

B. This is typical of putting your device (NIC) whatever in promiscuous mode, collecting packets for later analysis.

When a network is placed in promiscuous mode, this is done with the intention of retrieving or sniffing packets. This helps feed the packets to a protocol analyzer to log and analyze traffic. The small device in the switch would be the hardware that is part of the hybrid (software + hardware) approach to protocol analysis. WRONG ANSWERS • A – credential scanning is not a passive method in any way, and refers to the use of login credentials to test sys • B – passive scanning is typically a way of looking for vulnerabilities without actively logging into them or triggering them in any way • D – SCAP is a system for assisting with patch scanning and vulnerabilities. This is not what is described and might not be part of a pen tester’s efforts. • E – network segmentation is a logical division of networks using the firmware/software. It can also be done via hardware, but would be done so in the case of unique, separate hardware (switches) for that dedicated network.

B. is correct

Passive scanning involves monitoring network traffic without actively sending any packets or requests.