EC-Council
312-50V10 · Question #684
312-50V10 Question #684: Real Exam Question with Answer & Explanation
The correct answer is A: The switches will drop into hub mode if the ARP cache is successfully flooded.. MAC flooding with a tool like Macof overwhelms a switch's CAM (MAC address) table, causing the switch to fail open and behave like a hub, forwarding all frames out every port.
Question
Nathan is testing some of his network devices. Nathan is using Macof to try and flood the ARP cache of these switches. If these switches' ARP cache is successfully flooded, what will be the result?
Options
- AThe switches will drop into hub mode if the ARP cache is successfully flooded.
- BIf the ARP cache is flooded, the switches will drop into pix mode making it less susceptible to
- CDepending on the switch manufacturer, the device will either delete every entry in its ARP cache
- DThe switches will route all traffic to the broadcast address created collisions.
Explanation
MAC flooding with a tool like Macof overwhelms a switch's CAM (MAC address) table, causing the switch to fail open and behave like a hub, forwarding all frames out every port.
Common mistakes.
- B. 'Pix mode' is not a valid or recognized operational state for network switches and does not exist in standard switch behavior.
- C. Deleting ARP cache entries describes behavior related to ARP cache exhaustion, not MAC table flooding, and is not the fail-open response switches exhibit.
- D. Switches do not route all traffic to a broadcast address as a result of CAM table overflow; they forward unicast frames out all ports, which is functionally different from broadcasting.
Concept tested. MAC flooding attack and switch fail-open behavior
Reference. https://www.cisco.com/c/en/us/support/docs/lan-switching/ethernet/10556-41.html
Community Discussion
No community discussion yet for this question.