Sniffing and ARP Poisoning CEH Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A network administrator wants to detect ARP poisoning on the network. Which approach would provide the most reliable detection?

   • AUse a packet sniffer to capture all ARP traffic.
   • BUse a firewall to block ARP packets.
   • CMonitor the ARP cache on critical hosts for changes.
   • DDisable ARP on the network.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A network administrator is choosing a defense against ARP poisoning. The network has a mix of DHCP and static IP clients, and the switches are older models that do not support DHCP snooping or DAI. Which countermeasure would be most effective in this environment?

   • AUse a VLAN to segment the network.
   • BUse static ARP entries on all hosts and the gateway.
   • CDeploy an ARP spoofing detection tool on critical hosts.
   • DEnable port security on the switches.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which command-line tool is commonly used to capture and analyze network packets on Linux systems?

   • Atcpdump
   • Bping
   • Cnetstat
   • Dtraceroute
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A security analyst is troubleshooting a network where users report that they cannot access the internet, but they can access internal resources. The analyst captures traffic and sees a large number of DHCP offers from an unknown server. The DHCP server is configured correctly, but the analyst suspects a rogue DHCP server. Which action would be most effective to mitigate this attack?

   • ADisable DHCP on the network.
   • BEnable DHCP snooping on the switches.
   • CUse a packet sniffer to identify the rogue server's IP address.
   • DChange the DHCP server's IP address.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A security team is investigating a suspected ARP poisoning attack. The network uses DHCP for all clients, and the switch supports DHCP snooping and Dynamic ARP Inspection (DAI). However, the attack still succeeded. Which misconfiguration could have allowed the attack to bypass DAI?

   • AThe attacker used a static ARP entry to bypass DAI.
   • BThe DHCP snooping binding table was empty because clients use static IP addresses.
   • CThe switch was not configured with a DHCP snooping database.
   • DThe switch port connecting the attacker was configured as a trusted port for DAI.
   Reveal Solution Discussion Select an answer first