N10-009 Network Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  A) DHCP starvation

  Why this is correct

  DHCP starvation is an attack where a malicious actor rapidly sends numerous DHCP Discover messages to the DHCP server, each containing a spoofed MAC address. This malicious activity aims to exhaust the server's entire pool of available IP addresses, preventing legitimate clients from obtaining network configurations. As a result, new clients attempting to join the network will be unable to receive an IP address, effectively denying them service and causing a network outage for new connections.

• ✗

  B) ARP poisoning

  Why it's wrong here

  ARP poisoning, also known as ARP spoofing, is a technique where an attacker sends forged Address Resolution Protocol (ARP) messages over a local area network. These malicious messages associate the attacker's MAC address with the IP address of another legitimate host, such as the default gateway, in the ARP caches of other devices. This allows the attacker to intercept, modify, or drop traffic between the two poisoned hosts, creating a man-in-the-middle scenario, but it is not detectable through DHCP server logs.

  When this WOULD be correct

  A question describing a scenario where an attacker sends forged ARP replies to redirect traffic, causing man-in-the-middle attacks or network eavesdropping, would make ARP poisoning the correct answer.

• ✗

  C) MAC flooding

  Why it's wrong here

  MAC flooding is a Layer 2 attack designed to overwhelm a network switch's MAC address table, also known as the CAM table, with a multitude of fake MAC-to-port mappings. When the table becomes full, the switch may enter a fail-open mode, behaving like a hub by broadcasting all incoming traffic to every port. This allows the attacker to capture traffic not intended for them, but it does not directly involve DHCP server logs or IP address assignment processes.

  When this WOULD be correct

  A question describing a switch receiving many frames with random source MAC addresses, causing the CAM table to overflow and the switch to flood traffic out all ports, would make MAC flooding the correct answer.

• ✗

  D) DNS spoofing

  Why it's wrong here

  DNS spoofing, or DNS cache poisoning, involves an attacker injecting fraudulent DNS records into a DNS resolver's cache or directly responding with malicious information to a client's DNS query. The objective is to redirect users attempting to access legitimate websites to attacker-controlled sites, often for phishing or malware distribution. This attack operates at the application layer and manipulates name resolution, which is distinct from the network layer functions of DHCP.

  When this WOULD be correct

  A user reports being redirected to a fake banking website despite typing the correct URL. The network team finds that DNS queries for the bank's domain return an incorrect IP address. In this scenario, DNS spoofing would be the correct answer.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question