200-201 Security Concepts Practice Question
An attacker intercepts communication between a client and server and modifies the data being transmitted. The client and server are unaware of the modification. Which type of attack is being performed?
⚠ Common exam trap
200-201 often tests the distinction between broad attack categories and specific techniques, so candidates may incorrectly choose a specific method like ARP spoofing or DNS poisoning when the question describes the general behavior of a MITM attack.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Man-in-the-Middle
A Man-in-the-Middle (MITM) attack occurs when an attacker secretly relays and possibly alters the communication between two parties who believe they are directly communicating with each other. In this scenario, the attacker intercepts and modifies the data in transit, and neither the client nor the server detects the modification, which is the hallmark of a MITM attack. MITM is a broad category that encompasses various techniques, including ARP spoofing and DNS poisoning, but the core definition is the active interception and modification of traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Man-in-the-Middle
Why this is correct
A man-in-the-middle attack places the adversary inline between client and server, letting them relay and alter transmitted data while both endpoints believe they communicate directly. This interception plus undetected modification is precisely the behaviour described in the scenario.
- ✗
ARP spoofing
Why it's wrong here
ARP spoofing poisons the local ARP cache to redirect Layer 2 traffic, but it does not itself alter payload contents in transit. It is tempting because it enables man-in-the-middle positioning, which is the prerequisite step before modification occurs.
- ✗
DNS poisoning
Why it's wrong here
DNS poisoning corrupts resolver records so clients reach attacker-chosen addresses; it redirects name resolution rather than modifying data inside an established session. It is tempting because it also enables interception, but the stem specifies alteration of transmitted data, not redirection.
- ✗
Replay attack
Why it's wrong here
A replay attack retransmits previously captured valid traffic without altering its contents, so the server receives unchanged data. It is tempting because it also involves interception, but the stem requires modification of the transmitted data, which replaying does not perform.
About these practice questions
This 200-201 question is part of Courseiva's 968-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.