N10-009 Network Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  ARP poisoning

  Why it's wrong here

  ARP poisoning, or ARP spoofing, is a technique where an attacker sends falsified ARP messages over a local area network. This associates the attacker's MAC address with the IP address of another host, such as the default gateway, on the network, thereby rerouting traffic through the attacker. While ARP poisoning is a common method used to redirect traffic and establish a Man-in-the-Middle position, it is the underlying mechanism for achieving interception, not the overarching attack type of intercepting data between two legitimate hosts.

  When this WOULD be correct

  A question that asks: 'An attacker sends forged ARP messages to associate their MAC address with the IP address of a default gateway. Which type of attack is this?' would make ARP poisoning the correct answer.

• ✗

  DNS poisoning

  Why it's wrong here

  DNS poisoning involves injecting falsified DNS records into a DNS resolver's cache or a DNS server itself, causing it to return an incorrect IP address for a legitimate domain name. This redirects users attempting to access a specific website or service to an attacker-controlled malicious site instead of the intended destination. While it can lead to a user connecting to a malicious host, it primarily manipulates the initial name resolution process rather than directly intercepting an ongoing data stream between two already-connected legitimate hosts.

  When this WOULD be correct

  A question describing an attacker modifying DNS cache entries to redirect users to a fake login page for credential harvesting would make DNS poisoning the correct answer.

• ✓

  Man-in-the-middle

  Why this is correct

  A Man-in-the-Middle (MITM) attack occurs when an attacker secretly intercepts and potentially alters the communication between two parties who believe they are directly communicating with each other. The attacker positions themselves in the data path, effectively becoming an intermediary that can eavesdrop on, capture, or even manipulate the data in real-time without either legitimate party being aware of the compromise. This direct interception of data between two hosts perfectly matches the scenario described.

• ✗

  Replay attack

  Why it's wrong here

  A replay attack involves an attacker capturing a legitimate data transmission, such as authentication credentials or a transaction request, and then retransmitting it later to impersonate a legitimate user or trigger a repeated action. The attacker does not actively intercept or modify the data in real-time during the original communication. Instead, they passively record the traffic and then 'replay' the captured packets at a later time to achieve their malicious objective, which is distinct from real-time interception.

  When this WOULD be correct

  An exam question might describe an attacker capturing a valid authentication packet and retransmitting it later to gain unauthorized access, without any mention of traffic redirection or a rogue device. In that scenario, replay attack would be the correct answer.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”