nerdexam
EC-Council

312-50V9 · Question #609

Which type of sniffing technique is generally referred as MiTM attack?

The correct answer is B. ARP Poisoning. ARP Poisoning is the sniffing technique most closely associated with Man-in-the-Middle attacks because it actively redirects Layer 2 traffic through the attacker's machine.

Sniffing

Question

Which type of sniffing technique is generally referred as MiTM attack?

Exhibit

312-50V9 question #609 exhibit

Options

  • APassword Sniffing
  • BARP Poisoning
  • CMac Flooding
  • DDHCP Sniffing

How the community answered

(30 responses)
  • A
    3% (1)
  • B
    87% (26)
  • C
    10% (3)

Why each option

ARP Poisoning is the sniffing technique most closely associated with Man-in-the-Middle attacks because it actively redirects Layer 2 traffic through the attacker's machine.

APassword Sniffing

Password Sniffing describes the goal or outcome of intercepting credentials from captured traffic - it is not a positioning technique and does not by itself place an attacker between two hosts.

BARP PoisoningCorrect

ARP Poisoning works by broadcasting forged ARP reply packets that map the attacker's MAC address to a legitimate host's IP address, causing victim devices to send traffic to the attacker instead of the intended destination. This positions the attacker transparently between two communicating hosts - the core definition of a Man-in-the-Middle attack. Once in position, the attacker can capture, read, modify, or forward packets without either party being aware.

CMac Flooding

MAC Flooding overwhelms a switch's Content Addressable Memory table to force broadcast behavior, which can expose traffic but does not surgically position the attacker in-path between two specific communicating hosts.

DDHCP Sniffing

DHCP Sniffing or DHCP spoofing can be used to redirect traffic by assigning a rogue gateway, but it is a distinct attack vector and is not the technique most commonly labeled as the canonical MiTM method.

Concept tested: ARP Poisoning as a Man-in-the-Middle technique

Source: https://www.cisa.gov/uscert/ncas/tips/ST04-015

Topics

#ARP poisoning#MiTM#sniffing#layer 2 attack

Community Discussion

No community discussion yet for this question.

Full 312-50V9 Practice