Sniffing and ARP Poisoning CEH Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A network administrator is troubleshooting a network issue where a user cannot access the internet. The administrator captures traffic on the user's machine and sees that the user is sending ARP requests for the default gateway but never receives a reply. What is the MOST likely cause?

   • AThe user's machine is in promiscuous mode and not sending ARP requests.
   • BThe switch port is configured with port security that is blocking ARP requests.
   • CThe user's machine has a static ARP entry for the gateway with the wrong MAC.
   • DThe default gateway is down or unreachable.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which of the following tools is commonly used for network sniffing and protocol analysis?

   • AMetasploit
   • BWireshark
   • CJohn the Ripper
   • DNmap
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A network administrator is troubleshooting a security incident where a user's machine has an incorrect ARP entry for the default gateway. The administrator suspects ARP poisoning. The network uses a switch that supports DHCP snooping and Dynamic ARP Inspection (DAI). The administrator checks the switch configuration and finds that DAI is enabled on the VLAN. However, the attack still occurred. What is the MOST likely reason?

   • AThe attacker used a static ARP entry on the victim's machine, bypassing DAI.
   • BDAI only validates ARP requests, not ARP replies.
   • CDAI is only effective on access ports, not trunk ports.
   • DThe DHCP snooping database is not populated for the attacker's port, so DAI does not validate ARP packets from that port.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A network administrator is implementing countermeasures against ARP poisoning. The network has a mix of DHCP and static IP clients. The administrator wants to use switch-based features. Which combination of features would provide the most comprehensive protection?

   • AStatic ARP entries and a firewall.
   • BDHCP snooping, Dynamic ARP Inspection (DAI), and IP Source Guard.
   • CPort security and VLAN segmentation.
   • DUse a VPN for all traffic.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which countermeasure is specifically effective in detecting ARP poisoning attacks on a network?

   • ADisabling the Spanning Tree Protocol on all switches.
   • BEnabling DHCP snooping on the network.
   • CUsing ARP spoofing detection tools that monitor ARP traffic for anomalies.
   • DUsing a firewall to block all ARP traffic.
   Reveal Solution Discussion Select an answer first