Question 4 of 464
N10-009 Network Security Practice Question
A network security analyst notices high CPU utilization on the core switch and detects a large volume of ARP replies from a single IP address that claims to be the default gateway for all local subnets. Which type of attack is MOST likely occurring?
⚠ Common exam trap
The N10-009 exam often tests the distinction between ARP poisoning and MAC flooding by describing symptoms like 'high CPU utilization' and 'large volume of ARP replies,' which can mislead candidates into thinking MAC flooding is the answer because it also causes high CPU, but the key clue is the specific use of ARP replies targeting the default gateway IP.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ARP poisoning
The attack described is ARP poisoning (also known as ARP spoofing), where an attacker sends forged ARP replies to associate their MAC address with the IP address of the default gateway. This causes all traffic destined for other subnets to be redirected to the attacker's machine, leading to high CPU utilization on the switch as it processes the flood of ARP packets and forwards the intercepted traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
ARP poisoning
Why this is correct
ARP poisoning involves an attacker sending unsolicited, forged ARP reply messages to devices on a local network. These replies falsely associate the attacker's MAC address with the IP address of a legitimate network device, such as the default gateway or another host. This manipulation redirects network traffic through the attacker's machine, enabling man-in-the-middle attacks, data interception, or session hijacking. The high volume of replies and claiming to be the gateway are strong indicators of this attack.
- ✗
DHCP starvation
Why it's wrong here
DHCP starvation is a denial-of-service attack where an attacker floods a DHCP server with numerous DHCP DISCOVER requests, each using a spoofed MAC address. The goal is to exhaust the server's available IP address pool, preventing legitimate clients from obtaining network configurations. This attack focuses on IP address allocation and does not involve sending forged ARP replies or impersonating a gateway.
When this WOULD be correct
A network administrator notices clients failing to obtain IP addresses and the DHCP server logs show a high volume of DHCPDISCOVER messages from spoofed MAC addresses. This scenario indicates a DHCP starvation attack.
- ✗
MAC flooding
Why it's wrong here
MAC flooding overwhelms a network switch's Content Addressable Memory (CAM) table by sending a high volume of Ethernet frames, each with a unique, spoofed source MAC address. When the CAM table becomes full, the switch may revert to a 'fail-open' or hub-like mode, broadcasting all incoming traffic out of every port. This allows an attacker to sniff traffic, but it does not involve sending forged ARP replies or claiming to be a network gateway.
When this WOULD be correct
MAC flooding would be correct in a scenario where an attacker sends numerous frames with random source MAC addresses to a switch, aiming to overflow the CAM table and force the switch into hub mode, allowing the attacker to sniff traffic across VLANs.
- ✗
DNS amplification
Why it's wrong here
DNS amplification is a type of Distributed Denial-of-Service (DDoS) attack that leverages open DNS resolvers to flood a target with large volumes of DNS response traffic. Attackers send small DNS queries with a spoofed source IP address (the victim's) to multiple DNS servers, which then reply with much larger responses directed at the victim. This attack operates at the application layer (DNS over UDP) and does not involve manipulating ARP tables or local network impersonation.
When this WOULD be correct
A question describing a network under DDoS attack with high outbound traffic, where the attacker uses small DNS queries to generate large responses from misconfigured DNS servers, overwhelming the target's bandwidth.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓ARP poisoningCorrect answer▾
Why this is correct
ARP poisoning involves an attacker sending unsolicited, forged ARP reply messages to devices on a local network. These replies falsely associate the attacker's MAC address with the IP address of a legitimate network device, such as the default gateway or another host. This manipulation redirects network traffic through the attacker's machine, enabling man-in-the-middle attacks, data interception, or session hijacking. The high volume of replies and claiming to be the gateway are strong indicators of this attack.
✗DHCP starvationWrong answer — click to see why▾
Why this is wrong here
DHCP starvation floods a DHCP server with fake requests to exhaust its IP address pool, causing denial of service. It does not involve ARP replies or claiming to be a default gateway.
★ When this WOULD be the correct answer
A network administrator notices clients failing to obtain IP addresses and the DHCP server logs show a high volume of DHCPDISCOVER messages from spoofed MAC addresses. This scenario indicates a DHCP starvation attack.
Why candidates choose this
Candidates may confuse DHCP starvation with ARP poisoning because both involve spoofing and can lead to man-in-the-middle attacks, but they target different protocols (DHCP vs. ARP).
✗MAC floodingWrong answer — click to see why▾
Why this is wrong here
MAC flooding overwhelms a switch's CAM table with fake MAC addresses, causing it to fail open and flood traffic to all ports. The question describes ARP replies from a single IP claiming to be the default gateway, which is characteristic of ARP poisoning, not MAC flooding.
★ When this WOULD be the correct answer
MAC flooding would be correct in a scenario where an attacker sends numerous frames with random source MAC addresses to a switch, aiming to overflow the CAM table and force the switch into hub mode, allowing the attacker to sniff traffic across VLANs.
Why candidates choose this
Candidates may confuse MAC flooding with ARP poisoning because both involve sending spoofed frames to manipulate network behavior, and both can lead to traffic interception.
✗DNS amplificationWrong answer — click to see why▾
Why this is wrong here
DNS amplification attacks involve sending small queries with a spoofed source IP to open DNS servers, which then send large responses to the victim, causing bandwidth exhaustion. This does not involve ARP replies or high CPU on a switch.
★ When this WOULD be the correct answer
A question describing a network under DDoS attack with high outbound traffic, where the attacker uses small DNS queries to generate large responses from misconfigured DNS servers, overwhelming the target's bandwidth.
Why candidates choose this
Candidates may confuse any attack involving spoofed IPs or high resource utilization with DNS amplification, without recognizing the specific ARP-based mechanism described.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 11, 2026
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.