CompTIA Network+ Practice Test

Double tagging attacks primarily exploit which aspect of VLAN configuration?

1. The traffic flow between switches

2. The removal of native VLAN tags

3. The authentication process on switches

4. The configuration of trunk links

The correct answer is: The removal of native VLAN tags

Double tagging attacks exploit the configuration of trunk links in VLANs, specifically how VLAN tags are handled when data frames are transmitted between switches. In a double tagging attack, the attacker sends a frame with two VLAN tags: one for the native VLAN and another for the target VLAN. When the frame is transmitted over a trunk link, the first switch removes the outer tag (the native VLAN tag) and forwards the frame to the next switch, believing it belongs to the native VLAN. The next switch then processes the inner tag, which designates the target VLAN for the attacker's traffic. This allows an attacker to send packets intended for one VLAN while disguising them within the native VLAN, thereby bypassing security controls that might be in place. Thus, while the removal of native VLAN tags is part of the process, it does not encapsulate the broader aspect being exploited—namely, the vulnerabilities in trunk link configurations that facilitate these double tagging attacks. This kind of attack underscores the importance of properly configuring native VLANs and ensuring that trunk links do not allow unexpected VLAN traffic.