A penetration tester is performing an internal assessment and needs to capture credentials transmitted over HTTP from a specific user's workstation. The tester has physical access to the network but not to the workstation. Which approach would be most effective?

Use tcpdump to capture traffic on the switch's uplink port.

Use Ettercap to perform ARP poisoning between the workstation and the gateway, then capture traffic with Wireshark.

Use Wireshark in promiscuous mode on the tester's laptop connected to the same switch.

Use Cain & Abel to perform MAC flooding and then capture traffic.

A network administrator is setting up a monitoring solution to capture traffic on a switched network without disrupting operations. The goal is to analyze traffic between two servers. Which method should the administrator use?

Use a hub between the servers and the switch.

Use ARP poisoning to redirect the servers' traffic to the monitoring host.

Configure a SPAN port on the switch to mirror traffic from the servers' ports to a monitoring port.

Use tcpdump on the servers themselves.

A security analyst is testing the network for ARP poisoning vulnerabilities. The analyst wants to intercept traffic between a client and the gateway without disrupting the client's connectivity. Which tool and technique combination would achieve this?

Use Ettercap to perform ARP poisoning and enable IP forwarding on the attacker's machine.

Use Wireshark to capture traffic in promiscuous mode on the client's segment.

Use tcpdump to sniff traffic on the gateway's interface.

Use Cain & Abel to perform MAC flooding and then capture traffic.

A security analyst is reviewing packet captures and notices that the ARP cache on a server has been modified to point to an unknown MAC address. The analyst also sees a high volume of ARP replies from a single IP address. Which countermeasure would be most effective in preventing this type of attack in the future?

Use a network sniffer to monitor ARP traffic.

Change the server's IP address.

Enable Dynamic ARP Inspection (DAI) on the switch.

What is the primary goal of a MAC flooding attack?

To disable the switch's Spanning Tree Protocol to create network loops.

To exhaust the target's CPU by sending excessive ARP requests.

To spoof the gateway's MAC address and intercept all outbound traffic.

To flood the switch's CAM table so it fails open and broadcasts traffic to all ports.

EC-CouncilCertified Ethical Hacker

Domain 4Objective 1

Sniffing and ARP Poisoning CEH Practice Questions (Page 6)

Part of the Network and Perimeter Hacking domain, which makes up ~9% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~9–14 in this domain), expect 2–3 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

5concepts

Questions 26–30

26application · medium
A penetration tester is performing an internal assessment and needs to capture credentials transmitted over HTTP from a specific user's workstation. The tester has physical access to the network but not to the workstation. Which approach would be most effective?
Select an answer first
27application · medium
A network administrator is setting up a monitoring solution to capture traffic on a switched network without disrupting operations. The goal is to analyze traffic between two servers. Which method should the administrator use?
Select an answer first
28application · medium
A security analyst is testing the network for ARP poisoning vulnerabilities. The analyst wants to intercept traffic between a client and the gateway without disrupting the client's connectivity. Which tool and technique combination would achieve this?
Select an answer first
29application · medium
A security analyst is reviewing packet captures and notices that the ARP cache on a server has been modified to point to an unknown MAC address. The analyst also sees a high volume of ARP replies from a single IP address. Which countermeasure would be most effective in preventing this type of attack in the future?
Select an answer first
30foundation · easy
What is the primary goal of a MAC flooding attack?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.