PT0-002 Attacks and Exploits Practice Question
A penetration tester is conducting a network attack and wants to intercept traffic between two hosts on the same local network by spoofing ARP responses. Which tool is specifically designed for this purpose?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Bettercap
Bettercap is a powerful tool that includes ARP spoofing capabilities for man-in-the-middle attacks on local networks.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Bettercap
Why this is correct
Bettercap is a modular network attack framework with a built-in ARP spoofer module. By sending forged ARP replies, it can redirect traffic between a target host and the gateway, placing the tester in the middle of the conversation. This enables passive sniffing, session hijacking, and content injection, making it the correct choice for ARP-based MITM attacks.
- ✗
Responder
Why it's wrong here
Responder is designed to poison name resolution protocols such as LLMNR, NBT-NS, and mDNS, not ARP. It listens for name queries and responds with false answers, causing victims to send credentials to the attacker's host. It does not forge ARP layer-2 frames, so it cannot perform ARP spoofing or full MITM interception of existing unicast traffic.
- ✗
Hashcat
Why it's wrong here
Hashcat is a high-speed password recovery tool that cracks hashes using GPU-accelerated attack modes such as dictionary, brute-force, and rule-based attacks. It operates entirely offline on captured or extracted credential hashes and has no capability to send packets on a network. Therefore it is completely unsuited for ARP spoofing or live MITM.
- ✗
John the Ripper
Why it's wrong here
John the Ripper is a CPU-based password cracker that focuses on offline hash analysis, including Unix password hashes and many other formats. Its workflow involves taking a hash file and attempting password guesses, not interacting with network protocols. It cannot forge ARP replies or intercept live traffic, so it fails as a MITM tool.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PT0-003 question from scratch — 777 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.