A network administrator is explaining the difference between passive and active sniffing to a junior analyst. The administrator wants to give an example of passive sniffing. Which scenario is an example of passive sniffing?

An attacker connects to a hub and captures all traffic on the segment

An attacker sends ARP replies to redirect traffic to their machine

An attacker configures a SPAN port on a switch to mirror traffic

An attacker floods the switch with MAC addresses to force broadcast

What is the purpose of MAC flooding in the context of packet sniffing?

To poison the ARP cache of a target machine to redirect traffic

To send a large number of packets to a single port to overwhelm it

To overflow the switch's MAC address table so it forwards traffic to all ports

To flood the network with ICMP packets to cause a denial of service

A network administrator is troubleshooting a slow network and suspects that a switch is being flooded with MAC addresses. The administrator wants to confirm this without disrupting the network. Which action is most appropriate?

Disable the switch ports one by one to isolate the issue

Reboot the switch to clear the CAM table

Check the switch's CAM table for an excessive number of MAC addresses on a single port

Use a packet sniffer to capture traffic on the switch

A security team is investigating a suspected ARP poisoning attack on a switched network. The team wants to confirm the attack without disrupting operations. Which action is most appropriate?

Disable ARP on the affected hosts to stop the attack

Use a packet sniffer to capture all traffic and look for ARP replies

Flood the network with ARP requests to see which hosts respond

Check the ARP cache on the affected hosts for unexpected MAC addresses

EC-CouncilEthical Hacking Essentials

Domain 5Objective 1

Packet Sniffing Concepts EHE Practice Questions (Page 6)

Part of the Network-Level Attacks and Countermeasures domain, which makes up ~12% of our current practice bank.

40questions here

8free pages

5concepts

Questions 26–30

26application · medium
A network administrator is explaining the difference between passive and active sniffing to a junior analyst. The administrator wants to give an example of passive sniffing. Which scenario is an example of passive sniffing?
Select an answer first
27foundation · easy
What is the purpose of MAC flooding in the context of packet sniffing?
Select an answer first
28foundation · easy
Which packet sniffing tool is known for its graphical user interface and protocol dissection capabilities?
Select an answer first
29expert · hard
A network administrator is troubleshooting a slow network and suspects that a switch is being flooded with MAC addresses. The administrator wants to confirm this without disrupting the network. Which action is most appropriate?
Select an answer first
30expert · hard
A security team is investigating a suspected ARP poisoning attack on a switched network. The team wants to confirm the attack without disrupting operations. Which action is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to EHE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “EHE” is a trademark of its owner, used for identification only.