nerdexam
Cisco

200-201 · Question #130

Refer to the exhibit. What is occurring in this network?

The correct answer is A. ARP cache poisoning. The exhibit displays arpspoof commands being executed, which are used to inject false ARP entries into network devices' caches, indicating that ARP cache poisoning is occurring.

Submitted by katya_ua· Mar 6, 2026Network Intrusion Analysis

Question

Refer to the exhibit. What is occurring in this network?

Exhibit

200-201 question #130 exhibit

Options

  • AARP cache poisoning
  • BDNS cache poisoning
  • CMAC address table overflow
  • DMAC flooding attack

How the community answered

(17 responses)
  • A
    76% (13)
  • B
    12% (2)
  • C
    6% (1)
  • D
    6% (1)

Why each option

The exhibit displays `arpspoof` commands being executed, which are used to inject false ARP entries into network devices' caches, indicating that ARP cache poisoning is occurring.

AARP cache poisoningCorrect

The exhibit shows the `arpspoof` utility being run with specific IP addresses as targets, which is a common tool used to perform ARP cache poisoning. This attack involves sending forged ARP (Address Resolution Protocol) messages onto a local area network to associate the attacker's MAC address with the IP address of another host (like the default gateway or another client), thereby redirecting network traffic through the attacker.

BDNS cache poisoning

DNS cache poisoning involves injecting malicious data into a DNS resolver's cache, causing it to return incorrect IP addresses for domain names, which is distinct from manipulating ARP entries as shown.

CMAC address table overflow

A MAC address table overflow attack targets a switch's CAM table by flooding it with many fake MAC addresses, causing the switch to enter fail-open mode and broadcast frames, which is not what `arpspoof` directly does.

DMAC flooding attack

A MAC flooding attack is synonymous with a MAC address table overflow attack, aiming to overwhelm a switch's MAC address table, and is not directly performed by `arpspoof`.

Concept tested: ARP cache poisoning (ARP spoofing)

Source: https://learn.microsoft.com/en-us/windows/win32/winsock/address-resolution-protocol-arp-3

Topics

#ARP cache poisoning#network attacks#network traffic analysis#ARP protocol

Community Discussion

No community discussion yet for this question.

Full 200-201 Practice