Cisco
200-201 · Question #561
Refer to the exhibit. An engineer must interpret logs. What is occurring?
The correct answer is C. ARP poisoning. The same physical (MAC) address is associated with multiple IP addresses in the ARP table, which is a classic indicator that ARP responses have been spoofed to mislead hosts about the correct IP-to-MAC mappings.
Submitted by kavita_s· Mar 6, 2026Network Intrusion Analysis
Question
Refer to the exhibit. An engineer must interpret logs. What is occurring?
Exhibit
Options
- Ateardrop attack
- BMAC flooding attack
- CARP poisoning
- Ddenial-of-service attack
How the community answered
(25 responses)- B4% (1)
- C96% (24)
Explanation
The same physical (MAC) address is associated with multiple IP addresses in the ARP table, which is a classic indicator that ARP responses have been spoofed to mislead hosts about the correct IP-to-MAC mappings.
Topics
#ARP poisoning#network attacks#packet analysis
Community Discussion
No community discussion yet for this question.