200-201 · Question #130
Refer to the exhibit. What is occurring in this network?
The correct answer is A. ARP cache poisoning. The exhibit displays arpspoof commands being executed, which are used to inject false ARP entries into network devices' caches, indicating that ARP cache poisoning is occurring.
Question
Refer to the exhibit. What is occurring in this network?
Exhibit
Options
- AARP cache poisoning
- BDNS cache poisoning
- CMAC address table overflow
- DMAC flooding attack
How the community answered
(17 responses)- A76% (13)
- B12% (2)
- C6% (1)
- D6% (1)
Why each option
The exhibit displays `arpspoof` commands being executed, which are used to inject false ARP entries into network devices' caches, indicating that ARP cache poisoning is occurring.
The exhibit shows the `arpspoof` utility being run with specific IP addresses as targets, which is a common tool used to perform ARP cache poisoning. This attack involves sending forged ARP (Address Resolution Protocol) messages onto a local area network to associate the attacker's MAC address with the IP address of another host (like the default gateway or another client), thereby redirecting network traffic through the attacker.
DNS cache poisoning involves injecting malicious data into a DNS resolver's cache, causing it to return incorrect IP addresses for domain names, which is distinct from manipulating ARP entries as shown.
A MAC address table overflow attack targets a switch's CAM table by flooding it with many fake MAC addresses, causing the switch to enter fail-open mode and broadcast frames, which is not what `arpspoof` directly does.
A MAC flooding attack is synonymous with a MAC address table overflow attack, aiming to overwhelm a switch's MAC address table, and is not directly performed by `arpspoof`.
Concept tested: ARP cache poisoning (ARP spoofing)
Source: https://learn.microsoft.com/en-us/windows/win32/winsock/address-resolution-protocol-arp-3
Topics
Community Discussion
No community discussion yet for this question.
