It is possible to sniff traffic from other hosts on a switched Ethernet network by impersonating which type of network device?

Impersonating a switch does not redirect host traffic to an attacker because end hosts use ARP to resolve gateway addresses - they have no mechanism that would cause them to send traffic to an impersonated switch.

A bridge operates at Layer 2 similarly to a switch, and impersonating one does not cause end hosts to redirect their routed traffic toward the attacker.

Hubs already broadcast all frames to every connected port by design, so no impersonation is needed to capture traffic on a hub-based segment - they are not the target device to impersonate on a switched network.

By sending forged ARP replies that map the router's IP address to the attacker's MAC address, the attacker poisons the ARP caches of other hosts on the switched network. Those hosts then forward traffic destined for the gateway to the attacker instead, enabling a man-in-the-middle position where all outbound traffic can be captured and inspected.