Sniffing and ARP Poisoning CEH Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A network analyst is asked to capture traffic on a network segment that uses a switch. The analyst needs to see all traffic between multiple hosts. Which approach is most appropriate?

   • AUse ARP poisoning to redirect all traffic to the analyst's machine.
   • BUse a hub instead of a switch.
   • CUse promiscuous mode on the analyst's NIC.
   • DUse a SPAN port on the switch to mirror the relevant VLAN traffic.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security analyst is troubleshooting a report of intermittent connectivity on a small office LAN. While capturing traffic on the switch's SPAN port, the analyst notices that the destination MAC address for traffic to the default gateway is changing every few seconds, and the ARP cache on several workstations shows different MAC addresses for the same IP. Which action would BEST confirm the cause of this behavior?

   • AInspect the DHCP server logs to see if the gateway IP was assigned to a rogue device.
   • BRun a packet capture on the gateway interface and look for a high rate of ARP replies from multiple source MAC addresses.
   • CUse a protocol analyzer to filter for ICMP redirect messages sent by the gateway.
   • DCheck the switch's MAC address table for a single port that has learned more than one MAC address.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A security analyst is investigating a suspected ARP poisoning attack. The analyst runs Wireshark and sees a large number of ARP replies from a single MAC address claiming to be the gateway. The analyst also notices that the gateway's ARP cache has been modified. Which tool would be most effective to confirm the attack and identify the attacker?

   • AUse Arpwatch to monitor ARP changes and log the attacker's MAC address.
   • BUse Wireshark to follow the TCP stream.
   • CUse tcpdump to capture all traffic on the network.
   • DUse Nmap to scan the network for open ports.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   When performing an ARP poisoning attack with Ettercap, what is the typical first step after launching the tool?

   • ADisable the firewall on the target machine.
   • BScan the local network to identify potential target hosts.
   • CEnable IP forwarding on the attacker's machine to allow traffic to be relayed.
   • DCapture the target's credentials using a password sniffer.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is the primary purpose of the Address Resolution Protocol (ARP)?

   • ATo resolve IP addresses to MAC addresses on a local network.
   • BTo translate domain names into IP addresses.
   • CTo resolve MAC addresses to IP addresses across different networks.
   • DTo assign IP addresses to devices dynamically.
   Reveal Solution Discussion Select an answer first