Network Vulnerabilities & Attacks
A hospital network carries the most sensitive data there is. This topic maps how adversaries intercept, disrupt, and destroy that traffic — and how to assess the risk before it becomes a breach.
Once devices talk to each other, the conversation itself becomes a target. Adversaries can quietly listen in, secretly sit between two parties, flood a service offline, or slip onto the network through a forgotten port. Each move threatens the data's confidentiality, integrity, or availability.
Your job in this topic is to think like a risk analyst: name the attack, explain how a specific weakness enables it, and document the resulting risk so the team can prioritize a fix.
Intercept & Steal
Sniffing and on-path (man-in-the-middle) attacks capture or alter data as it crosses the wire.
ConfidentialityDisrupt & Deny
Denial-of-service floods overwhelm a system so authorized users — clinicians — can't reach it.
AvailabilityIntrude & Spread
Rogue access points and flat networks let adversaries join, then move laterally toward the records server.
Integrity · lateralYou've been brought in to analyze the network at Mercy Valley Hospital (fictional). Patient records, lab results, and the patient Wi-Fi all share infrastructure. Before any controls are added, your task is to find the network vulnerabilities and document the risk each one carries.
AP Learning Objectives
- 3.1.AIdentify common network attacks.
- 3.1.BExplain how adversaries exploit network vulnerabilities to steal, disrupt, or destroy network communication.
- 3.1.CAssess and document risks from network vulnerabilities.
A network vulnerability is dangerous because of what it lets an adversary do to the data: read it (confidentiality), change it (integrity), or block it (availability). Every risk you document should trace a weakness to one or more of those three outcomes.
What you'll be able to do: classify common network attacks, read network evidence to diagnose what's happening, map an attack to the CIA principle it harms, inspect a network architecture for weaknesses, chain an attack path, and write a documented network-risk record.
How Network Attacks Work — and What They Cost
Most network attacks fall into a few families. Knowing the family tells you what the adversary is after and which part of CIA is at stake.
An on-path (man-in-the-middle) attack secretly inserts the adversary between two parties — each thinks it's talking to the other, but both are really talking to the attacker, who can copy or alter the data. Sniffing (eavesdropping) captures traffic in transit without changing it. A denial-of-service (DoS) attack floods a system until authorized users can't reach it — and when many machines flood at once, it's a DDoS.
The way in matters too. An adversary who finds an open port can plug in a rogue access point and reach the LAN wirelessly, bypassing the firewall entirely. Insecure wireless leaks signals outside the building. And a flat, unsegmented network lets a single compromised device reach everything — including patient records — because nothing stands between segments.
Diagram · Network attack path
Diagram · CIA impact map
CIA Impact Mapper
Lab · MapSelect each attack on Mercy Valley's network, then drop it under the CIA principle it most directly harms.
Confidentiality
Data is read
Integrity
Data is altered
Availability
Data is blocked
Concept Check
30 secNetwork vulnerabilities can put which parts of the CIA triad at risk?
The Attack Catalog
The common network attacks and the weaknesses they exploit. These terms drive both MCQ and risk-analysis prompts.
| Attack | What it does |
|---|---|
| Sniffing / eavesdropping | Captures and copies data in transit without altering it. |
| On-path (man-in-the-middle) | Secretly relays between two parties, copying or altering their messages. |
| Denial of service (DoS/DDoS) | Floods a system so authorized users can't reach it; many sources at once is a DDoS. |
| Rogue access point | An AP plugged into an open port, giving wireless LAN access that bypasses the firewall. |
| Insecure wireless | Weak encryption or signals leaking outside the building enable interception. |
| Weak segmentation | A flat network lets one compromised device reach everything (lateral movement). |
| Insecure protocol exposure | Unfiltered or unencrypted protocols (e.g., open ICMP, plaintext services) leak data or aid mapping. |
Network Attack Classifier
Lab · 7 casesRead each behavior, then name the attack it describes.
What the Exam Rewards
This topic is Analyze Risk — skills 1.C (evaluate likelihood and impact) and 1.D (document likelihood and impact).
Skill 1.C. Weigh likelihood and impact separately. Many network exploits need advanced skill — which can lower the likelihood even when the potential impact is severe.
Skill 1.D. Document the risk: the vulnerable asset and its value, the threat, the specific vulnerability and how it's exploited, the CIA impact, and a final rating.
Common MCQ traps
"Sniffing and MITM are the same thing."
Sniffing only reads traffic. An on-path/MITM attack sits between parties and can alter it.
"A firewall stops a rogue access point."
A rogue AP on an internal port gives LAN access that bypasses the firewall — port security is the real fix.
"High impact always means high risk."
Risk weighs impact and likelihood. A severe attack that needs rare expertise may be less likely.
Analyst note — Mercy Valley: an automated vulnerability scanner flags the guest Wi-Fi as sharing one flat LAN with the records server, and notes weak wireless encryption. The report lists each finding with a severity and a mitigation — exactly the inputs you need to document risk.
Packet / Event Evidence Board
Lab · 5 casesThe monitoring console surfaces an indicator. Diagnose which attack the evidence points to.
Document a Network Risk
The headline skill: turn a vulnerability into a documented risk record. First see the chain, then build the record.
Diagram · Asset–vulnerability–threat–risk chain
Network Risk Documentation Builder
Lab · Analyze + DocumentAssemble a network risk for Mercy Valley, set likelihood and severity, and generate the documented record.
Qualitative risk matrix · likelihood × severity
Misconceptions That Cost Points
Each is a planted wrong answer. Learn to see the trap.
"A DoS attack steals data."
DoS attacks block availability — they make a system unreachable. Stealing data is a confidentiality attack.
"Network segmentation only helps speed."
Segmentation also limits lateral movement — a flat LAN lets one compromised device reach everything.
"If it's wireless and has a password, it's safe."
Weak encryption can be broken, and signals leaking outside the building can be intercepted.
"An open Ethernet jack is harmless."
An adversary can plug in to reach the LAN or add a rogue access point — unless port security is enabled.
"Hard-to-exploit means low impact."
Difficulty affects likelihood, not impact. A hard exploit can still be catastrophic if it succeeds.
"A vulnerability scanner fixes the problems."
It finds and rates known vulnerabilities and suggests fixes — applying them is a separate step.
Vulnerability Map & Attack Path
A reference table for matching weaknesses to impact, plus two labs: inspect the hospital network, then chain the attack.
| Vulnerability | Enables | Primary CIA impact |
|---|---|---|
| Insecure wireless | Eavesdropping, interception | Confidentiality |
| Open switch port | Rogue AP, MAC flooding | Confidentiality / Availability |
| Flat / unsegmented LAN | Lateral movement to sensitive systems | Confidentiality / Integrity |
| No / misconfigured firewall | Flooding, mapping, spoofing | Availability / Integrity |
| Exposed insecure protocol | Sniffing, network mapping | Confidentiality |
| No device authentication | Adversary joins the network | All three |
Network Architecture Vulnerability Inspector
Lab · InspectClick each component of Mercy Valley's network to inspect it. Find all the weaknesses — one component is already secured correctly.
Select a component
Click any box on the network map to inspect it for vulnerabilities.
Attack Path Chain Builder
Lab · SequenceThese five steps describe how an adversary could reach patient records. Click them in order, then check the chain.
Steps
Attack path
Prove the Risk Analysis
Five AP-style questions with instant feedback, then a snapshot to lock it in.
Mini AP-Style Quiz
Lab · 5 questionsChoose one answer per question, then submit for scored feedback with explanations.
Five Takeaways
Know the families. Sniffing reads, on-path/MITM alters, DoS/DDoS blocks, rogue APs intrude.
Map to CIA. Every network attack threatens confidentiality, integrity, and/or availability.
Entry points chain. An open port or rogue AP can bypass the firewall and reach the records server on a flat LAN.
Likelihood ≠ impact. Advanced-skill exploits lower likelihood; rate the two factors separately.
Document the risk. Asset + value, threat, vulnerability and how it's exploited, CIA impact, final rating.
Final AP exam tip: to explain how an attack exploits a vulnerability, trace the chain — name the weakness, the attack it enables, and which CIA principle suffers. For risk-assessment prompts, rate likelihood and impact separately and justify both.
One mistake to avoid: don't confuse the attack with its effect. "DoS" isn't "data theft," and "sniffing" isn't "altering." Naming the precise effect on CIA is what earns the point.
Practice — attempt these now.
AP-style assessments aligned to this lesson. Time them.