Sniffing and ARP Poisoning CEH Practice Questions (Page 8)

Questions 36–38

1. 36expert · hard

   A penetration tester is performing an ARP poisoning attack to intercept traffic between a client and the gateway. The tester wants to modify the traffic in transit. Which tool would be most appropriate for this task?

   • Atcpdump with a write filter.
   • BNmap with a script.
   • CEttercap with a filter script.
   • DWireshark with a capture filter.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A network administrator wants to prevent ARP poisoning attacks on a critical VLAN that hosts database servers. The administrator has already enabled port security on the switches to limit MAC addresses per port. Which additional measure would provide the most effective defense against ARP spoofing?

   • ADeploy a network intrusion detection system (IDS) to monitor for ARP anomalies.
   • BUse static ARP entries on all hosts and the gateway.
   • CConfigure Dynamic ARP Inspection (DAI) on the switches.
   • DEnable IP Source Guard on all access ports.
   Reveal Solution Discussion Select an answer first
3. 38foundation · easy

   In the context of network sniffing, what is the primary difference between passive and active sniffing?

   • APassive sniffing only works on wireless networks, while active sniffing is used on wired networks.
   • BPassive sniffing requires root privileges, while active sniffing does not require any special privileges.
   • CPassive sniffing involves injecting packets into the network, while active sniffing only observes traffic.
   • DPassive sniffing simply captures traffic without altering it, while active sniffing actively injects traffic to redirect or modify data.
   Reveal Solution Discussion Select an answer first