A network engineer is troubleshooting intermittent connectivity issues on a segment where a new DHCP server was deployed. Users report that some devices cannot obtain IP addresses, while others get addresses but cannot reach the internet. The engineer suspects a DHCP attack. Which attack would cause both symptoms?

DHCP starvation followed by a rogue DHCP server

A network administrator is investigating a security incident where a user's credentials were stolen. The administrator suspects ARP poisoning was used. The network uses a hub in one segment and a switch in another. Which statement is TRUE regarding the feasibility of sniffing on these segments?

On the switch segment, a host can sniff all traffic by enabling promiscuous mode; on the hub segment, ARP poisoning is required.

On both segments, ARP poisoning is required to sniff traffic because modern switches and hubs filter traffic.

ARP poisoning is only effective on hub segments because switches validate ARP packets.

On the hub segment, any host can sniff all traffic without ARP poisoning; on the switch segment, ARP poisoning is required to redirect traffic.

A security consultant is testing a client's network for ARP poisoning vulnerabilities. The consultant wants to demonstrate the attack without causing a denial of service. Which tool and configuration would be appropriate?

Use Ettercap with IP forwarding enabled.

Use Wireshark to send spoofed ARP replies.

Use tcpdump to perform ARP poisoning.

Use Cain & Abel with ARP poisoning but disable IP forwarding.

A penetration tester is performing an ARP poisoning attack on a network that uses DHCP. The tester wants to intercept traffic between a client and the gateway. The tester also wants to avoid detection by the network's IDS, which monitors for ARP anomalies. Which technique would be most effective?

Use a tool that sends ARP replies with the correct MAC address.

Send ARP replies at a low rate to avoid triggering the IDS threshold.

Use a static ARP entry on the attacker's machine.

EC-CouncilCertified Ethical Hacker

Domain 4Objective 1

Sniffing and ARP Poisoning CEH Practice Questions (Page 2)

Part of the Network and Perimeter Hacking domain, which makes up ~9% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~9–14 in this domain), expect 2–3 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

5concepts

Questions 6–10

6application · medium
A network engineer is troubleshooting intermittent connectivity issues on a segment where a new DHCP server was deployed. Users report that some devices cannot obtain IP addresses, while others get addresses but cannot reach the internet. The engineer suspects a DHCP attack. Which attack would cause both symptoms?
Select an answer first
7expert · hard
A network administrator is investigating a security incident where a user's credentials were stolen. The administrator suspects ARP poisoning was used. The network uses a hub in one segment and a switch in another. Which statement is TRUE regarding the feasibility of sniffing on these segments?
Select an answer first
8foundation · easy
Which tool is specifically designed to perform ARP poisoning and can also intercept and modify traffic in a man-in-the-middle attack?
Select an answer first
9application · medium
A security consultant is testing a client's network for ARP poisoning vulnerabilities. The consultant wants to demonstrate the attack without causing a denial of service. Which tool and configuration would be appropriate?
Select an answer first
10expert · hard
A penetration tester is performing an ARP poisoning attack on a network that uses DHCP. The tester wants to intercept traffic between a client and the gateway. The tester also wants to avoid detection by the network's IDS, which monitors for ARP anomalies. Which technique would be most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.

Sniffing and ARP Poisoning CEH Practice Questions (Page 2)

Questions 6–10

A network administrator is investigating a security incident where a user's credentials were stolen. The administrator suspects ARP poisoning was used. The network uses a hub in one segment and a switch in another. Which statement is TRUE regarding the feasibility of sniffing on these segments?

Which tool is specifically designed to perform ARP poisoning and can also intercept and modify traffic in a man-in-the-middle attack?

A security consultant is testing a client's network for ARP poisoning vulnerabilities. The consultant wants to demonstrate the attack without causing a denial of service. Which tool and configuration would be appropriate?

A penetration tester is performing an ARP poisoning attack on a network that uses DHCP. The tester wants to intercept traffic between a client and the gateway. The tester also wants to avoid detection by the network's IDS, which monitors for ARP anomalies. Which technique would be most effective?

Keep studying — Network and Perimeter Hacking