In an ARP poisoning attack, what does the attacker typically do to redirect traffic?

Send forged ARP replies to associate the attacker's MAC address with the IP address of the victim or gateway.

Flood the network with ARP requests to exhaust the switch's CAM table.

Send a DHCP request to obtain a new IP address and impersonate the victim.

Modify the victim's routing table to send traffic through the attacker.

A network administrator is asked to capture traffic for a security audit. The network uses a switch, and the administrator needs to capture traffic between two specific servers without affecting other traffic. The switch supports SPAN but not RSPAN. Which approach should the administrator use?

Use a network tap between the servers and the switch.

Configure a SPAN port on the switch to mirror the two servers' ports to a monitoring port.

Use ARP poisoning to redirect the servers' traffic to the monitoring host.

Use tcpdump on the servers themselves.

Which of the following is an effective countermeasure to protect against sniffing attacks on a switched network?

Using a hub instead of a switch to connect all devices.

Implementing port security to limit the number of MAC addresses allowed on a switch port.

Disabling Dynamic Host Configuration Protocol (DHCP) on the network.

Setting all switch ports to trunk mode.

A security auditor is performing a passive sniffing test on a network segment that uses a hub. The auditor wants to capture all traffic without being detected. Which tool and mode is BEST suited for this task?

Wireshark in promiscuous mode on the auditor's laptop connected to the hub.

tcpdump with the 'monitor' mode on a wireless interface.

Ettercap with ARP poisoning to redirect traffic to the auditor's laptop.

Cain & Abel with MAC flooding to force the hub into fail-open mode.

A penetration tester is performing an ARP poisoning attack to intercept HTTPS traffic. The tester wants to decrypt the traffic. Which additional step is necessary for the attack to be successful?

Use a stronger encryption algorithm.

Perform an SSL stripping attack to downgrade HTTPS to HTTP.

Use a different ARP poisoning tool.

EC-CouncilCertified Ethical Hacker

Domain 4Objective 1

Sniffing and ARP Poisoning CEH Practice Questions (Page 7)

Part of the Network and Perimeter Hacking domain, which makes up ~9% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~9–14 in this domain), expect 2–3 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

5concepts

Questions 31–35

31foundation · easy
In an ARP poisoning attack, what does the attacker typically do to redirect traffic?
Select an answer first
32expert · hard
A network administrator is asked to capture traffic for a security audit. The network uses a switch, and the administrator needs to capture traffic between two specific servers without affecting other traffic. The switch supports SPAN but not RSPAN. Which approach should the administrator use?
Select an answer first
33foundation · easy
Which of the following is an effective countermeasure to protect against sniffing attacks on a switched network?
Select an answer first
34application · medium
A security auditor is performing a passive sniffing test on a network segment that uses a hub. The auditor wants to capture all traffic without being detected. Which tool and mode is BEST suited for this task?
Select an answer first
35expert · hard
A penetration tester is performing an ARP poisoning attack to intercept HTTPS traffic. The tester wants to decrypt the traffic. Which additional step is necessary for the attack to be successful?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.