CSA (312-39) SOC Simulation Lab

Master network-level threat hunting. Learn to differentiate between denial of service techniques and interception tactics on local subnets.

Scenario Context

You are a Tier 3 SOC Analyst at Horizon Financial. The Helpdesk escalates an urgent ticket: for the past 15 minutes, no new devices in the corporate headquarters can connect to the Wi-Fi or wired network on VLAN 40. Existing devices that were already connected are functioning perfectly, but new connections continuously time out during the "Obtaining IP address" phase.

You pivot to your SIEM to investigate the DHCP server logs for VLAN 40 and run a query against your core switches to understand why IP allocation is failing.

Security Environment

Excerpt from the SIEM query (Index: network_syslog | Source: dhcp-core-01):

[INFO] 10:42:01 dhcpd: DHCPDISCOVER from 00:1a:2b:3c:4d:5e via eth1
[INFO] 10:42:01 dhcpd: DHCPOFFER on 10.40.1.105 to 00:1a:2b:3c:4d:5e
[INFO] 10:42:01 dhcpd: DHCPDISCOVER from 02:f3:a1:b2:c4:d5 via eth1
[INFO] 10:42:01 dhcpd: DHCPOFFER on 10.40.1.106 to 02:f3:a1:b2:c4:d5
... [500 identical requests with randomized CHADDR/MACs within 2 seconds] ...
[INFO] 10:42:03 dhcpd: DHCPDISCOVER from 08:00:27:5a:1b:2c via eth1
[CRIT] 10:42:03 dhcpd: network 10.40.1.0/24: no free leases

[IDS ALERT] ET DOS Possible DHCP Exhaustion Attack - Source Interface: Gi1/0/14

Question

Which of the following attack inundates DHCP servers with fake DHCP requests to exhaust all available IP addresses?

SOC Hint: Look closely at the phrase "exhaust all available IP addresses". The attacker is trying to deplete a resource so legitimate users are left "hungry" for network access.

Expert Insight

What is happening here?

An attacker connected to switch port Gi1/0/14 is likely running an automated tool (such as Yersinia or a custom Python script using Scapy). This tool rapidly broadcasts DHCPDISCOVER packets, each containing a randomized source MAC address. The DHCP server dutifully responds by reserving an IP address (`DHCPOFFER`) for each fake client until the entire subnet scope (10.40.1.0/24) is fully depleted. Legitimate endpoints attempting to join the network are denied service because the server has "no free leases".

Why the correct answer is correct (A. DHCP Starvation Attacks)

DHCP Starvation perfectly describes the act of inundating a server with fake requests specifically to exhaust its IP address pool. It is essentially a Denial of Service (DoS) attack targeting the DHCP infrastructure.

Why the other options are wrong

B. DHCP Spoofing Attack: In a spoofing (or Rogue DHCP) attack, the attacker sets up their *own* DHCP server to distribute malicious gateway and DNS configurations to clients. While starvation is often used as "Phase 1" to knock out the legitimate server so the rogue one can take over, spoofing itself is not the act of exhausting IPs.

C. DHCP Port Stealing: Port stealing usually refers to flooding a switch's CAM (MAC address) table to force it to act like a hub, or spoofing a MAC to steal traffic destined for a specific switch port. It doesn't target the DHCP IP pool.

D. DHCP Cache Poisoning: This is a distractor. "Cache poisoning" applies to protocols like DNS or ARP. DHCP servers manage lease databases, not caches that are "poisoned" in this manner.

Real-world SOC Application

If you observe DHCP Starvation on your network, expect a Man-in-the-Middle (MitM) attack to follow immediately. Attackers starve the legitimate DHCP server so they can spin up a Rogue DHCP server (Spoofing). With the real server out of IPs, new clients will accept IP leases from the attacker's rogue server, which will assign the attacker's machine as the Default Gateway, allowing them to capture credentials and intercept traffic.

MINI LESSON: Defeating DHCP Starvation

As a SOC Analyst communicating with Network Engineering, you should recommend two standard Layer 2 mitigations to permanently kill this attack vector:

Port Security (MAC Limiting): Configure edge switches to restrict the number of MAC addresses allowed per port (e.g., switchport port-security maximum 2). This stops an attacker from generating hundreds of fake MACs on a single physical link.
DHCP Snooping: A security feature that acts like a firewall between untrusted hosts and trusted DHCP servers. It validates DHCP messages received from untrusted sources and rate-limits DHCP traffic to prevent flooding.

Ready to level up your incident response skills?

Explore more CSA simulations by ExamRange