While a school district is performing state testing, a security analyst notices all internet services are unavailable. The analyst discovers that ARP poisoning is occurring on the network and then…

Question

Options

• AUnskilled attacker
• BShadow IT
• CInsider threat
• DNation-state

• A
  8% (2)
• B
  4% (1)
• C
  83% (20)
• D
  4% (1)

Explanation

ARP poisoning is a Layer 2, local-network attack - the attacker must be physically or logically on the same network segment to send spoofed ARP replies, which points directly to an insider threat (C). The deliberate timing during state testing also signals someone with knowledge of school operations, reinforcing insider motive and opportunity.

Why the distractors are wrong:

• A (Unskilled attacker): ARP poisoning requires technical know-how and - critically - local network access; an unskilled external attacker couldn't execute this.
• B (Shadow IT): Shadow IT describes unauthorized but unintentionally harmful devices/software (e.g., a personal hotspot); it implies no malicious intent, unlike a deliberate attack.
• D (Nation-state): Nation-state actors use sophisticated, stealthy, long-term campaigns (APTs) against high-value targets - not disruptive LAN-layer attacks on a school district.

Memory tip: Think "ARP = Adjacent = Insider." Any attack that requires being on the same local network (ARP, DHCP starvation, MAC flooding) implies the attacker is adjacent to the network - a hallmark of an insider threat scenario on the exam.

No community discussion yet for this question.