N10-009 Network Security Practice Question
A security analyst is investigating a potential breach. A network device shows logs indicating that it received packets with a source IP address belonging to the internal network range on its external (internet-facing) interface. This is a classic indication of which type of attack?
⚠ Common exam trap
Watch out — candidates often confuse IP spoofing with a DoS attack because spoofing is often used in DDoS amplification, but the question's specific clue—internal source IP on an external interface—directly points to spoofing, not the volumetric nature of a DoS.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
IP spoofing
B is correct because receiving packets with a source IP address from the internal network range on an external (internet-facing) interface is a classic sign of IP spoofing. In IP spoofing, an attacker forges the source IP address in packet headers to impersonate a trusted internal host, often to bypass access controls or launch reflection attacks. This violates the expected behavior of ingress filtering, where external interfaces should never see internal source addresses.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Denial-of-service (DoS) attack
Why it's wrong here
A Denial-of-Service (DoS) attack aims to make a machine or network resource unavailable to its intended users by overwhelming it with traffic or exploiting a vulnerability. While DoS attacks can sometimes involve IP spoofing to hide the attacker's identity, the primary symptom is resource exhaustion or service disruption, not specifically the appearance of internal source IP addresses on an external network interface. The described observation is a direct indicator of source IP address manipulation, which is a specific technique, not the overarching goal of a DoS attack.
When this WOULD be correct
A question describing a network device being overwhelmed with traffic from multiple sources, causing service disruption, would make DoS the correct answer. For example: 'A web server becomes unresponsive due to a flood of TCP SYN packets from many different IP addresses.'
- ✓
IP spoofing
Why this is correct
IP spoofing involves an attacker deliberately altering the source IP address in packet headers to impersonate a legitimate or trusted host, often an internal network device. When a security analyst observes packets originating from an internal IP address on an external network interface (like a WAN port), it unequivocally indicates that an external entity is forging these source IPs. This technique is frequently used to bypass ingress filtering rules or to obscure the attacker's true identity, making it a definitive sign of a potential breach.
- ✗
Man-in-the-middle (MITM) attack
Why it's wrong here
A Man-in-the-Middle (MITM) attack involves an attacker secretly relaying and possibly altering the communication between two parties who believe they are directly communicating with each other. While MITM attacks intercept traffic, they typically operate by positioning the attacker between the legitimate endpoints, often within the same local network segment, to eavesdrop or manipulate data. The scenario described, specifically seeing internal source IPs on an external interface, points to source address forgery rather than the interception and relay mechanism characteristic of a MITM attack.
When this WOULD be correct
A question describing an attacker intercepting traffic between a client and server, possibly using ARP spoofing or a rogue access point, and then modifying or eavesdropping on the communication would make MITM the correct answer.
- ✗
ARP poisoning
Why it's wrong here
ARP poisoning is a Layer 2 attack where an attacker sends forged Address Resolution Protocol (ARP) messages onto a local area network. This manipulates the MAC address tables of switches and the ARP caches of hosts, associating the attacker's MAC address with the IP address of a legitimate network device. Since ARP operates strictly within a local broadcast domain and does not traverse routers, it cannot cause internal source IP addresses to appear on an external, routed interface, making it inconsistent with the observed symptom.
When this WOULD be correct
A question describing an attacker sending forged ARP replies to associate their MAC address with the IP of a legitimate device, causing traffic to be misdirected, would make ARP poisoning the correct answer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓IP spoofingCorrect answer▾
Why this is correct
IP spoofing involves an attacker deliberately altering the source IP address in packet headers to impersonate a legitimate or trusted host, often an internal network device. When a security analyst observes packets originating from an internal IP address on an external network interface (like a WAN port), it unequivocally indicates that an external entity is forging these source IPs. This technique is frequently used to bypass ingress filtering rules or to obscure the attacker's true identity, making it a definitive sign of a potential breach.
✗Denial-of-service (DoS) attackWrong answer — click to see why▾
Why this is wrong here
The logs show packets with an internal source IP arriving on the external interface, which is a sign of IP spoofing, not a DoS attack. DoS attacks focus on overwhelming resources, not on forging source addresses.
★ When this WOULD be the correct answer
A question describing a network device being overwhelmed with traffic from multiple sources, causing service disruption, would make DoS the correct answer. For example: 'A web server becomes unresponsive due to a flood of TCP SYN packets from many different IP addresses.'
Why candidates choose this
Candidates may associate any malicious traffic with DoS, especially when logs show unusual packets, without recognizing that the specific indicator (internal IP on external interface) points to spoofing rather than resource exhaustion.
✗Man-in-the-middle (MITM) attackWrong answer — click to see why▾
Why this is wrong here
A man-in-the-middle attack involves intercepting and potentially altering communications between two parties, but the specific indicator of packets with an internal source IP on an external interface points to IP spoofing, not MITM.
★ When this WOULD be the correct answer
A question describing an attacker intercepting traffic between a client and server, possibly using ARP spoofing or a rogue access point, and then modifying or eavesdropping on the communication would make MITM the correct answer.
Why candidates choose this
Candidates may confuse IP spoofing with MITM because both involve deceptive IP addresses, but MITM focuses on interception and relay, not just falsifying the source address.
✗ARP poisoningWrong answer — click to see why▾
Why this is wrong here
ARP poisoning operates at Layer 2 and involves corrupting ARP caches within a local network segment, not receiving packets with internal source IPs on an external interface.
★ When this WOULD be the correct answer
A question describing an attacker sending forged ARP replies to associate their MAC address with the IP of a legitimate device, causing traffic to be misdirected, would make ARP poisoning the correct answer.
Why candidates choose this
Candidates may confuse IP spoofing with ARP poisoning because both involve falsifying addresses, but ARP poisoning is specific to MAC-IP mapping on local networks, not the external interface scenario described.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
IPv4 Address Class Summary
| Class | First Octet Range | Default Mask | Networks | Hosts per Network |
|---|---|---|---|---|
| A | 1–126 | /8 (255.0.0.0) | 126 | 16,777,214 |
| B | 128–191 | /16 (255.255.0.0) | 16,384 | 65,534 |
| C | 192–223 | /24 (255.255.255.0) | 2,097,152 | 254 |
| D | 224–239 | N/A | Multicast groups | — |
| E | 240–255 | N/A | Reserved / experimental | — |
127.x.x.x is reserved for loopback. Modern networks use CIDR (classless) rather than classful addressing.
Go deeper
Related to this question
Learn chapter
Network Device Hardening
Key term
IP address
An IP address is a unique numerical label assigned to each device connected to a computer network that uses the Internet Protocol for communication.
Key term
Packet
A packet is a small unit of data that is sent over a network, containing both the actual data and control information for delivery.
About these practice questions
Courseiva writes every N10-009 question from scratch — 464 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.