PT0-002 Practice Question: A penetration tester is performing a…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  To assign a fake IP address to the attacker's device

  Why it's wrong here

  In ARP spoofing, the attacker never assigns a fake IP address to their own interface; doing so would be DHCP spoofing or basic IP address spoofing. Instead, the attacker leaves their own IP address unchanged and forges ARP reply packets that claim their MAC address maps to the victim's or gateway's IP address. This is a critical distinction because the attack injects a false IP-to-MAC mapping into the victim's ARP cache, not a new address assignment on the attacker's NIC.

• ✓

  To associate the attacker's MAC address with the IP address of a legitimate host

  Why this is correct

  This is the core of an ARP spoofing attack: the attacker sends unsolicited ARP replies (or broadcasts) asserting that the legitimate host's IP address corresponds to the attacker's MAC address. The victim's ARP cache then updates, causing frames destined for that IP to be sent to the attacker's network interface instead of the real host. The attacker can silently intercept, inspect, or forward those frames to the actual host, creating a transparent layer-2 man-in-the-middle position.

• ✗

  To modify the routing table of the target

  Why it's wrong here

  ARP spoofing cannot modify a target's routing table because it operates exclusively at Layer 2, manipulating the ARP cache rather than the Layer 3 forwarding table. Routing tables are altered through techniques such as route injection, OSPF/RIP manipulation, or ICMP redirects—not by forged ARP replies. Confusing these two layers is a common misunderstanding, especially when checking whether an ARP attack changes `route print` or `ip route` output; it never does.

• ✗

  To poison the DNS cache of the target

  Why it's wrong here

  DNS cache poisoning is a separate attack that corrupts a resolver's name-to-IP mappings at the application layer, typically by injecting forged DNS responses into a resolver's cache. ARP spoofing does not alter DNS data at all; it only changes which MAC address receives frames sent to a particular IP address. While ARP spoofing can enable an attacker to redirect a DNS query to a rogue server, that is a downstream consequence, not a direct modification of the DNS cache itself.

Go deeper

Related to this question