A penetration tester is performing ARP spoofing against a switch. Which of the following should the penetration tester spoof to get the MOST information?

Spoofing a single client's MAC address lets the attacker intercept only that client's traffic, a far smaller subset than all traffic flowing through the gateway.

Spoofing the domain controller's MAC captures authentication traffic but misses general browsing, application, and internet-bound traffic that does not pass through the DC.

Spoofing the web server's MAC only intercepts traffic directed specifically to that server, significantly limiting the scope of captured data.

The default gateway is the single chokepoint through which all traffic destined outside the local subnet flows; by poisoning host ARP caches with the attacker's MAC in place of the gateway's MAC, the attacker redirects and captures the maximum volume of network traffic, yielding the broadest man-in-the-middle position possible on that subnet.