A network administrator is trying to determine whether an attacker is passively sniffing the network or actively intercepting traffic. The network uses switches. Which observation would indicate active sniffing?

The switch's CAM table is full of MAC addresses on a single port

The switch logs show a large number of ARP requests

A host's network interface is in promiscuous mode

The network monitoring system shows high CPU usage on the switch

What is the primary purpose of packet sniffing in the context of network monitoring?

To encrypt data packets to protect them from interception

To modify packet headers to reroute traffic through a proxy

To block malicious traffic before it reaches its destination

To capture and analyze data packets traversing a network segment

Which countermeasure is most effective in preventing an attacker from reading the contents of captured packets?

Using a hub instead of a switch

Using encryption protocols such as TLS or IPsec

A penetration tester is conducting a security assessment and needs to capture credentials transmitted over the network. The target network uses a switch, and the tester has physical access to the network but not administrative access to the switch. The tester wants to minimize the chance of detection. Which tool and technique should the tester use?

Use tcpdump to capture traffic on the switch's management port.

Use Cain & Abel to perform ARP poisoning and capture traffic.

Use Wireshark in promiscuous mode on a laptop connected to the switch.

Use a network TAP to passively capture traffic.

EC-CouncilEthical Hacking Essentials

Domain 5Objective 1

Packet Sniffing Concepts EHE Practice Questions (Page 1)

Part of the Network-Level Attacks and Countermeasures domain, which makes up ~12% of our current practice bank.

40questions here

8free pages

5concepts

Questions 1–5

1expert · hard
A network administrator is trying to determine whether an attacker is passively sniffing the network or actively intercepting traffic. The network uses switches. Which observation would indicate active sniffing?
Select an answer first
2foundation · easy
What is the primary purpose of packet sniffing in the context of network monitoring?
Select an answer first
3foundation · easy
Which countermeasure is most effective in preventing an attacker from reading the contents of captured packets?
Select an answer first
4foundation · easy
Which tool is a Windows-based packet sniffer that also includes password recovery features?
Select an answer first
5expert · hard
A penetration tester is conducting a security assessment and needs to capture credentials transmitted over the network. The target network uses a switch, and the tester has physical access to the network but not administrative access to the switch. The tester wants to minimize the chance of detection. Which tool and technique should the tester use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to EHE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “EHE” is a trademark of its owner, used for identification only.

Packet Sniffing Concepts EHE Practice Questions (Page 1)

Questions 1–5

A network administrator is trying to determine whether an attacker is passively sniffing the network or actively intercepting traffic. The network uses switches. Which observation would indicate active sniffing?

What is the primary purpose of packet sniffing in the context of network monitoring?

Which countermeasure is most effective in preventing an attacker from reading the contents of captured packets?

Which tool is a Windows-based packet sniffer that also includes password recovery features?

Keep studying — Network-Level Attacks and Countermeasures