nerdexam
EC-Council

312-50V12 · Question #246

In a large organization, a network security analyst discovered a series of packet captures that seem unusual. The network operates on a switched Ethernet environment. The security team suspects that…

The correct answer is B. The attacker might be implementing MAC flooding to overwhelm the switch's memory. In a switched Ethernet environment, an attacker can use MAC flooding to overwhelm the switch's MAC address table, forcing it to broadcast traffic like a hub and enabling packet sniffing.

Submitted by weili_xi· Mar 4, 2026Network and Perimeter Hacking

Question

In a large organization, a network security analyst discovered a series of packet captures that seem unusual. The network operates on a switched Ethernet environment. The security team suspects that an attacker might be using a sniffer tool. Which technique could the attacker be using to successfully carry out this attack, considering the switched nature of the network?

Options

  • AThe attacker might be compromising physical security to plug into the network directly.
  • BThe attacker might be implementing MAC flooding to overwhelm the switch's memory.
  • CThe attacker is probably using a Trojan horse with in-built sniffing capability.
  • DThe attacker might be using passive sniffing, as it provides significant stealth advantages.

How the community answered

(59 responses)
  • A
    7% (4)
  • B
    76% (45)
  • C
    3% (2)
  • D
    14% (8)

Why each option

In a switched Ethernet environment, an attacker can use MAC flooding to overwhelm the switch's MAC address table, forcing it to broadcast traffic like a hub and enabling packet sniffing.

AThe attacker might be compromising physical security to plug into the network directly.

While compromising physical security allows direct network access, it does not inherently bypass the unicast nature of a switched network to intercept *all* traffic without an additional technique.

BThe attacker might be implementing MAC flooding to overwhelm the switch's memory.Correct

MAC flooding involves sending a massive number of fake source MAC addresses to a switch, rapidly filling its Content Addressable Memory (CAM) table. Once the CAM table is full, the switch can no longer learn new MAC addresses and typically reverts to a fail-open mode, broadcasting all unknown unicast traffic out of all ports. This hub-like behavior allows the attacker to capture traffic destined for other hosts on the network segment.

CThe attacker is probably using a Trojan horse with in-built sniffing capability.

A Trojan horse with sniffing capabilities would primarily allow sniffing of traffic passing through the compromised host itself, not broader network traffic across a switched environment.

DThe attacker might be using passive sniffing, as it provides significant stealth advantages.

Passive sniffing is generally ineffective in a switched environment because traffic is typically unicast between specific ports, meaning a passive sniffer would only see broadcast traffic or traffic specifically addressed to its own host without a technique like MAC flooding or port mirroring.

Concept tested: MAC flooding attack in switched networks

Source: https://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/Security/Baseline_Security/sec_pres.html#wp1010328

Topics

#Network sniffing#Switched networks#MAC flooding#ARP poisoning

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 312-50V12 Practice