Which of the following descriptions of MAC address spoofing attacks is incorrect?

Question

Options

• AMAC address spoofing attacks will cause the switch to learn the wrong mapping relationship between MAC addresses and IP addresses.
• BA MAC address spoofing attack will cause the data that the switch wants to send to the correct destination to be sent to the attacker.
• CMAC address spoofing attacks mainly utilize the switch MAC address learning mechanism.
• DAn attacker can implement a MAC address spoofing attack by sending a data frame with a forged source MAC address to the switch.

• A
  81% (25)
• B
  3% (1)
• C
  10% (3)
• D
  6% (2)

Explanation

Option A is the incorrect description because switches operate at Layer 2 and maintain a MAC-to-port mapping table (the CAM table), not a MAC-to-IP mapping. Confusing MAC-to-IP mapping with MAC-to-port mapping is the error - that IP relationship is handled by ARP, making "ARP spoofing" the attack that corrupts MAC-to-IP bindings, not MAC address spoofing.

B is a correct description: once the switch's CAM table is poisoned with the attacker's port mapped to the victim's MAC, legitimate traffic destined for the victim gets forwarded to the attacker instead - that's the real-world harm.

C is a correct description: the switch's dynamic MAC learning mechanism (automatically trusting source MACs from incoming frames) is the vulnerability being exploited.

D is a correct description: the attack is executed simply by crafting a frame with a spoofed source MAC - no special access is required, just the ability to inject frames onto the network.

Memory tip: Think "switches are Layer 2 - they only know ports, never IP addresses." Any answer claiming a switch tracks MAC-to-IP is automatically wrong. If you see MAC + IP mapping on an exam, think ARP (Layer 3 concern), not switch MAC learning.

No community discussion yet for this question.