During an internal penetration test, several multicast and broadcast name resolution requests are observed traversing the network. Which of the following tools could be used to impersonate network…

Ettercap is a man-in-the-middle tool that relies on ARP poisoning and traffic interception rather than name resolution poisoning, so it does not actively respond to LLMNR or NBT-NS queries.

Tcpdump is a passive packet capture utility that records traffic traversing the network but has no capability to respond to or impersonate any network resource.

When a Windows host fails to resolve a name via DNS, it falls back to broadcast protocols - LLMNR and NBT-NS - by sending the query to the local network segment. Responder listens for these requests, replies with its own IP address to impersonate the requested resource, and then captures the NTLMv1 or NTLMv2 hash sent by the victim host as it attempts to authenticate - making Responder the specific tool designed for this exact attack vector.

Medusa is a parallelized brute-force authentication tool targeting services such as SSH and FTP, and it has no functionality related to name resolution poisoning or credential harvesting from broadcast protocols.