200-201 Security Monitoring Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Application layer

  Why it's wrong here

  The Application layer handles user-facing protocols such as HTTP and DNS, not logical addressing or routing, so it is not where IP spoofing occurs. It is tempting because many attacks, including phishing and injection, target applications, but IP spoofing manipulates source IP addresses at the Network layer.

• ✓

  Network layer

  Why this is correct

  The Network layer (Layer 3) handles logical addressing and routing, satisfying the stem's requirement. IP spoofing attacks forge source addresses within IP packets at this layer, exploiting the lack of authentication in the IP protocol. This makes Layer 3 the precise target, unlike the Transport layer's ports or Data Link layer's MAC addresses.

• ✗

  Transport layer

  Why it's wrong here

  The Transport layer manages end-to-end connections and ports, such as TCP and UDP, but not logical addressing or routing. It is tempting because port-based attacks and TCP spoofing exist, yet IP spoofing specifically forges source IP addresses, which belong to the Network layer.

• ✗

  Data Link layer

  Why it's wrong here

  The Data Link layer handles physical addressing via MAC addresses and framing, not logical addressing or routing. It is tempting because MAC spoofing is a real attack at this layer, but IP spoofing targets IP addresses, which are logical and reside at the Network layer.

Go deeper

Related to this question