Sniffing and ARP Poisoning CEH Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A penetration tester is on a switched network and needs to intercept and modify traffic between a client and a server for a red-team exercise. The tester has administrative access to a workstation on the same subnet. The client and server are both on the same VLAN. The tester wants to avoid disrupting the network and wants to ensure that the client can still reach the server during the test. Which approach BEST meets these requirements?

   • AUse ARP spoofing to associate the tester's MAC with the server's IP, then enable IP forwarding on the tester's machine.
   • BConfigure the switch port to monitor the server's traffic using SPAN and then inject packets.
   • CSend a DHCP starvation attack to exhaust the address pool, then assign the server's IP to the tester's machine.
   • DFlood the switch with fake MAC addresses to force it into hub mode, then capture all traffic.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A security analyst is investigating a network where users report slow internet and intermittent connectivity. The analyst captures traffic and sees a large number of ARP replies from a single MAC address claiming to be the gateway. The switch does not have DHCP snooping or DAI enabled. Which action would be most effective to stop the attack?

   • AChange the gateway's IP address.
   • BManually configure static ARP entries on all hosts for the gateway.
   • CDisable ARP on the gateway.
   • DUse a packet sniffer to identify the attacker's IP address.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A network analyst is using Wireshark to capture traffic on a network segment. The analyst notices that the capture contains many packets with the source MAC address of the default gateway but the source IP address of a different host. What does this indicate?

   • AThe host is sending packets with a spoofed MAC address to impersonate the gateway.
   • BThe gateway is sending packets on behalf of the host, which is normal for NAT.
   • CThe capture is corrupted and the MAC and IP addresses are mismatched.
   • DThe gateway is using proxy ARP to respond for the host.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A security analyst is investigating a suspected ARP poisoning attack. The analyst captures traffic and sees a large number of ARP replies from a single MAC address claiming to be the default gateway. The analyst also notices that the gateway's real MAC address is different. Which action would BEST confirm the attack and identify the attacking host?

   • ATrace the MAC address of the attacker in the switch's MAC address table to find the physical port.
   • BUse a protocol analyzer to filter for ARP requests from the attacker's IP.
   • CCheck the ARP cache of the gateway to see if it has the attacker's MAC.
   • DDisable the switch port that the gateway is connected to and see if the attack stops.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A network administrator is setting up a monitoring solution to detect unauthorized sniffing on the corporate network. The administrator wants to identify if any host is running its network interface in promiscuous mode. Which technique is MOST effective for this purpose?

   • AUse a network scanner to send packets with a destination MAC address that is not the host's but an IP address that is the host's, and see if the host responds.
   • BCheck the switch's CAM table for ports that have multiple MAC addresses.
   • CSend ARP requests to the suspected host and check if it responds to requests for other hosts' IP addresses.
   • DUse a protocol analyzer to look for hosts that are sending ARP replies without corresponding requests.
   Reveal Solution Discussion Select an answer first