Click the exhibit button. A penetration tester is performing an assessment when the network administrator shows the tester a packet sample that is causing trouble on the network. Which of the…

SNMP brute forcing would appear as high-volume repeated SNMP GET or SET requests on UDP port 161 using different community strings, not as ARP-level traffic anomalies.

ARP spoofing involves sending forged ARP reply packets that associate the attacker's MAC address with a legitimate host's IP address, poisoning the ARP cache of other devices and redirecting their traffic through the attacker for a man-in-the-middle position. The packet sample would display duplicate or conflicting gratuitous ARP replies where a single IP address resolves to more than one MAC address, the hallmark signature of this attack.

DNS cache poisoning manifests as manipulated DNS query and response packets on port 53 with falsified resource records, not as conflicting ARP broadcast traffic.

SMTP relay abuse appears as email messages traversing an open relay on port 25, generating SMTP session traffic, not ARP broadcast anomalies at the data-link layer.