N10-009 Network Security Practice Question
A security analyst detects that an attacker is sending forged ARP replies to associate the attacker's MAC address with the IP address of the default gateway. What is this attack called?
⚠ Common exam trap
The N10-009 exam often tests the distinction between ARP poisoning (which targets the ARP cache) and MAC flooding (which targets the switch's CAM table), leading candidates to confuse the two because both involve MAC addresses and network attacks.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ARP poisoning
ARP poisoning (also known as ARP spoofing) is the correct answer because the attacker sends forged ARP replies to associate their MAC address with the IP address of the default gateway. This causes the victim's switch to update its ARP cache with the attacker's MAC for the gateway's IP, enabling man-in-the-middle attacks where the attacker intercepts traffic destined for the gateway.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
ARP poisoning
Why this is correct
ARP poisoning, also known as ARP spoofing, is a man-in-the-middle attack where an attacker sends forged ARP (Address Resolution Protocol) messages over a local area network. By sending false ARP replies, the attacker associates their own MAC address with the IP address of another host, such as the default gateway. This causes the victim's traffic, intended for the gateway, to be incorrectly forwarded to the attacker's machine, allowing interception or modification.
- ✗
MAC flooding
Why it's wrong here
MAC flooding is an attack designed to overwhelm a network switch's Content Addressable Memory (CAM) table by sending a large number of frames, each with a unique source MAC address. When the CAM table becomes full, the switch can no longer store new MAC-to-port mappings and often reverts to a "fail-open" mode, broadcasting all incoming traffic out of every port. While this allows an attacker to sniff all network traffic, it does not involve forging ARP messages to redirect traffic specifically destined for the gateway.
When this WOULD be correct
A question describing an attack where an attacker sends a flood of packets with random source MAC addresses to force a switch into hub mode, allowing traffic sniffing, would have MAC flooding as the correct answer.
- ✗
DHCP snooping
Why it's wrong here
DHCP snooping is a layer 2 security feature implemented on network switches to filter untrusted DHCP messages and prevent rogue DHCP servers from assigning IP addresses. It builds and maintains a database of valid MAC-to-IP address bindings, dropping packets from unauthorized DHCP servers or clients attempting to use static IP addresses without proper authorization. As a defensive mechanism, it is not an attack method involving forged packets from an attacker, but rather a countermeasure.
When this WOULD be correct
A question describing an attack where a rogue DHCP server assigns false IP configurations to clients, causing traffic interception, would have DHCP snooping as the correct answer (e.g., 'What attack is mitigated by DHCP snooping?').
- ✗
DNS spoofing
Why it's wrong here
DNS spoofing, also known as DNS cache poisoning, involves corrupting the Domain Name System (DNS) resolution process to redirect users to malicious websites instead of their intended destinations. An attacker achieves this by injecting forged DNS records into a DNS resolver's cache or by directly intercepting DNS queries. This attack operates at the application layer (Layer 7) and manipulates domain name lookups, fundamentally differing from ARP poisoning which targets Layer 2 address resolution.
When this WOULD be correct
A question describing an attacker intercepting DNS queries and returning fake IP addresses to redirect users to a phishing site would make DNS spoofing the correct answer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓ARP poisoningCorrect answer▾
Why this is correct
ARP poisoning, also known as ARP spoofing, is a man-in-the-middle attack where an attacker sends forged ARP (Address Resolution Protocol) messages over a local area network. By sending false ARP replies, the attacker associates their own MAC address with the IP address of another host, such as the default gateway. This causes the victim's traffic, intended for the gateway, to be incorrectly forwarded to the attacker's machine, allowing interception or modification.
✗MAC floodingWrong answer — click to see why▾
Why this is wrong here
MAC flooding involves sending many frames with different source MAC addresses to overflow the switch's CAM table, not forging ARP replies to associate a MAC with a gateway IP.
★ When this WOULD be the correct answer
A question describing an attack where an attacker sends a flood of packets with random source MAC addresses to force a switch into hub mode, allowing traffic sniffing, would have MAC flooding as the correct answer.
Why candidates choose this
Candidates may confuse ARP poisoning with MAC flooding because both attacks manipulate MAC address tables and are used for man-in-the-middle or traffic interception purposes.
✗DHCP snoopingWrong answer — click to see why▾
Why this is wrong here
DHCP snooping is a security feature that filters untrusted DHCP messages to prevent rogue DHCP servers, not a method for forging ARP replies to associate a MAC with a gateway IP.
★ When this WOULD be the correct answer
A question describing an attack where a rogue DHCP server assigns false IP configurations to clients, causing traffic interception, would have DHCP snooping as the correct answer (e.g., 'What attack is mitigated by DHCP snooping?').
Why candidates choose this
Candidates may confuse DHCP snooping with ARP poisoning because both involve manipulating network mappings (IP-MAC) and are often covered together in security training.
✗DNS spoofingWrong answer — click to see why▾
Why this is wrong here
DNS spoofing involves corrupting DNS resolution to redirect traffic to malicious sites, not forging ARP replies to associate a MAC address with a gateway IP.
★ When this WOULD be the correct answer
A question describing an attacker intercepting DNS queries and returning fake IP addresses to redirect users to a phishing site would make DNS spoofing the correct answer.
Why candidates choose this
Candidates may confuse network-layer attacks, thinking 'spoofing' in DNS spoofing is similar to ARP spoofing, or they may misremember the specific attack vector for ARP poisoning.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Common Network Attacks
Key term
Media Access Control
Media Access Control (MAC) is a sublayer of the Data Link Layer in networking that controls how devices on the same network share access to the physical medium and uniquely identifies each device with a hardware address.
Key term
IP address
An IP address is a unique numerical label assigned to each device connected to a computer network that uses the Internet Protocol for communication.
About these practice questions
Courseiva writes every N10-009 question from scratch — 464 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.