nerdexam
CompTIA

SY0-501 · Question #245

A workstation puts out a network request to locate another system. Joe, a hacker on the network, responds before the real system does, and he tricks the workstation into communicating with him…

The correct answer is D. The hacker exploited weak switch configuration. This scenario describes an on-path (man-in-the-middle) attack enabled by weak network switch configuration, where an attacker intercepts and responds to network discovery requests faster than the legitimate system.

Submitted by minji_kr· Mar 4, 2026Threats, vulnerabilities, and mitigations

Question

A workstation puts out a network request to locate another system. Joe, a hacker on the network, responds before the real system does, and he tricks the workstation into communicating with him. Which of the following BEST describes what occurred?

Options

  • AThe hacker used a race condition.
  • BThe hacker used a pass-the-hash attack.
  • CThe hacker-exploited importer key management.
  • DThe hacker exploited weak switch configuration.

How the community answered

(17 responses)
  • A
    12% (2)
  • B
    6% (1)
  • D
    82% (14)

Why each option

This scenario describes an on-path (man-in-the-middle) attack enabled by weak network switch configuration, where an attacker intercepts and responds to network discovery requests faster than the legitimate system.

AThe hacker used a race condition.

A race condition is a software vulnerability where the outcome depends on the timing of uncontrolled events in code execution, not a network interception technique used to impersonate a system.

BThe hacker used a pass-the-hash attack.

A pass-the-hash attack involves stealing hashed credentials and using them to authenticate without knowing the plaintext password, which is unrelated to intercepting network discovery requests.

CThe hacker-exploited importer key management.

Improper key management refers to mishandling cryptographic keys (e.g., weak storage or rotation), which does not describe an attacker racing to respond to a network broadcast request.

DThe hacker exploited weak switch configuration.Correct

A weak switch configuration, such as lacking port security, dynamic ARP inspection (DAI), or DHCP snooping, allows an attacker to inject fraudulent ARP replies or spoof responses to network discovery requests. By exploiting these missing controls, the hacker can respond before the legitimate system, redirecting traffic to himself - a classic ARP spoofing or network interception attack rooted in poor switch hardening.

Concept tested: Network interception via weak switch security controls

Source: https://learn.microsoft.com/en-us/windows-server/networking/technologies/dhcp/dhcp-deploy-wps

Topics

#ARP spoofing#race condition#network attacks#switch security

Community Discussion

No community discussion yet for this question.

Full SY0-501 Practice