N10-009 Network Security Practice Question
A network security analyst notices that the firewall is logging traffic on the external interface that has a source IP address of 10.0.1.5, which is within the internal network range. This is most likely the result of which type of attack?
⚠ Common exam trap
Candidates often confuse IP spoofing with ARP poisoning, because both involve address impersonation, but ARP poisoning is a Layer 2 attack confined to the local subnet, whereas IP spoofing can originate from anywhere on the Internet and is visible on the external interface.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
IP spoofing
The firewall is logging traffic on its external interface with a source IP address from the internal RFC 1918 range (10.0.1.5). This indicates the source IP has been forged, because private IP addresses should never appear as source addresses on a public-facing interface. This is the classic signature of an IP spoofing attack, where the attacker modifies the source IP in the packet header to impersonate an internal host.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
DNS poisoning
Why it's wrong here
DNS poisoning involves injecting corrupt Domain Name System (DNS) data into a DNS resolver's cache, causing the resolver to return an incorrect IP address for a legitimate domain name. This redirects users to malicious websites or servers controlled by the attacker. Although it manipulates IP addresses in the context of domain resolution, it does not involve crafting individual packets with a forged *source* IP address to deceive a firewall about the packet's origin.
When this WOULD be correct
A question describing users being redirected to a malicious website despite typing the correct URL, with DNS logs showing altered records, would point to DNS poisoning.
- ✓
IP spoofing
Why this is correct
IP spoofing is the act of creating Internet Protocol (IP) packets with a forged source IP address, making the packet appear to originate from a different host than its actual sender. A firewall logging "IP spoofing" indicates it has detected incoming packets with source IP addresses that do not align with the expected network topology or routing rules, such as an external packet claiming an internal source IP. This technique is often used to bypass network access controls, launch denial-of-service attacks, or hide the attacker's identity.
- ✗
ARP poisoning
Why it's wrong here
ARP poisoning, or ARP spoofing, is a Layer 2 attack where an attacker sends falsified Address Resolution Protocol (ARP) messages over a local area network. This manipulates the ARP tables of other devices, associating the attacker's MAC address with the IP address of a legitimate host, such as a default gateway. While it allows traffic interception, it operates within a local broadcast domain and does not involve forging the source IP address of packets traversing a firewall, which primarily inspects Layer 3 and above.
- ✗
VLAN hopping
Why it's wrong here
VLAN hopping is a network attack that allows an attacker on one Virtual Local Area Network (VLAN) to gain unauthorized access to traffic on a different VLAN. This typically exploits misconfigurations in network switches, such as Dynamic Trunking Protocol (DTP) vulnerabilities or double-tagging attacks. While it enables an attacker to send or receive traffic across VLAN boundaries, the fundamental mechanism does not involve forging the source IP address of packets, but rather bypassing Layer 2 segmentation.
When this WOULD be correct
A network analyst notices that a host on VLAN 10 is receiving traffic intended for a host on VLAN 20, even though no routing or firewall rules allow inter-VLAN communication. This would most likely be the result of which type of attack?
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓IP spoofingCorrect answer▾
Why this is correct
IP spoofing is the act of creating Internet Protocol (IP) packets with a forged source IP address, making the packet appear to originate from a different host than its actual sender. A firewall logging "IP spoofing" indicates it has detected incoming packets with source IP addresses that do not align with the expected network topology or routing rules, such as an external packet claiming an internal source IP. This technique is often used to bypass network access controls, launch denial-of-service attacks, or hide the attacker's identity.
✗DNS poisoningWrong answer — click to see why▾
Why this is wrong here
DNS poisoning involves corrupting DNS resolution data to redirect traffic, not generating traffic with an internal source IP on an external interface.
★ When this WOULD be the correct answer
A question describing users being redirected to a malicious website despite typing the correct URL, with DNS logs showing altered records, would point to DNS poisoning.
Why candidates choose this
Candidates may confuse any attack involving IP addresses with DNS poisoning, or think that internal IPs on the external interface indicate DNS manipulation.
✗VLAN hoppingWrong answer — click to see why▾
Why this is wrong here
VLAN hopping attacks involve gaining access to traffic on other VLANs, typically by exploiting trunking protocols or double-tagging. The scenario describes a source IP address from the internal range appearing on the external interface, which is a classic sign of IP spoofing, not VLAN hopping.
★ When this WOULD be the correct answer
A network analyst notices that a host on VLAN 10 is receiving traffic intended for a host on VLAN 20, even though no routing or firewall rules allow inter-VLAN communication. This would most likely be the result of which type of attack?
Why candidates choose this
Candidates may confuse the concept of an internal IP appearing externally with VLAN hopping, thinking that the attacker is jumping VLANs to reach the external interface, rather than recognizing it as a spoofed source address.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
IPv4 Address Class Summary
| Class | First Octet Range | Default Mask | Networks | Hosts per Network |
|---|---|---|---|---|
| A | 1–126 | /8 (255.0.0.0) | 126 | 16,777,214 |
| B | 128–191 | /16 (255.255.0.0) | 16,384 | 65,534 |
| C | 192–223 | /24 (255.255.255.0) | 2,097,152 | 254 |
| D | 224–239 | N/A | Multicast groups | — |
| E | 240–255 | N/A | Reserved / experimental | — |
127.x.x.x is reserved for loopback. Modern networks use CIDR (classless) rather than classful addressing.
Go deeper
Related to this question
Learn chapter
Network Device Hardening
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Firewall
A firewall is a network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules to protect trusted internal networks from untrusted external networks.
About these practice questions
This N10-009 question is part of Courseiva's 464-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.