hardMultiple ChoiceObjective-mapped
PT0-002 Practice Question: During a penetration test, a tester identifies…
During a penetration test, a tester identifies that the target's network uses Private VLANs to isolate hosts. Which technique can be used to bypass this isolation and perform ARP spoofing?
⚠ Common exam trap
CompTIA often tests the distinction between VLAN hopping methods (DTP-based vs. double tagging), and the trap here is that candidates confuse double tagging with the general concept of VLAN hopping, but double tagging is not effective against Private VLANs because it relies on native VLAN misconfigurations on trunk ports, whereas DTP-based hopping directly negotiates a trunk to access all VLANs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
VLAN hopping
Private VLANs isolate hosts within the same VLAN by restricting traffic at the switch level. VLAN hopping (option D) allows an attacker to bypass this isolation by exploiting the switch's trunking protocol (e.g., DTP) to negotiate a trunk link, enabling the attacker to send and receive frames on multiple VLANs, including the target's community or isolated VLAN, thus facilitating ARP spoofing across the Private VLAN boundaries.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
ARP cache poisoning from the switch
Why it's wrong here
ARP cache poisoning is an on-path technique where an attacker sends forged ARP replies to associate their MAC address with a victim's IP, enabling traffic interception within a broadcast domain. However, this attack is typically launched from an attached host, not from the switch itself, and it operates at the ARP layer rather than the VLAN tag layer. Even if a switch were compromised, ARP poisoning would redirect frames within the same VLAN but would not overcome Private VLAN isolation, which is enforced by the switch's port-based rules. Therefore, it is not the method that bypasses Private VLAN restrictions.
- ✗
MAC flooding
Why it's wrong here
MAC flooding is a Layer 2 attack that overwhelms a switch's content-addressable memory (CAM) with false MAC addresses, causing the switch to fail open and flood frames out every port, effectively acting like a hub. While this allows an attacker to sniff traffic on the same broadcast domain, it does not directly bypass Private VLAN isolation because Private VLANs enforce traffic restrictions at the port level based on the configured port types (promiscuous, isolated, community), independent of the CAM table state. In fail-open mode, the switch may still drop frames between isolated ports due to the Private VLAN logic. Consequently, MAC flooding enables eavesdropping but not cross-VLAN access.
- ✗
Double tagging
Why it's wrong here
Double tagging is a specific VLAN hopping attack in which an attacker prepends two 802.1Q VLAN tags to a frame; the access switch strips the outer tag, and the inner tag is then processed by the trunk port, allowing the frame to enter a VLAN that should be off-limits. While this technique can bypass Private VLAN isolation by sending frames into another VLAN, it is only one implementation of VLAN hopping. The broader category of VLAN hopping also includes switch spoofing, where an attacker negotiates a trunk link to receive all VLAN traffic. Because the question asks for the general technique that bypasses Private VLANs, choosing the specific double-tagging variant is too narrow and therefore incorrect as the best answer.
- ✓
VLAN hopping
Why this is correct
VLAN hopping is a class of Layer 2 attacks that enables an attacker on one VLAN to send frames to another VLAN against the network's design, effectively breaking VLAN and Private VLAN isolation. The two primary methods are switch spoofing, where the attacker uses DTP to negotiate a trunk, and double tagging, where two VLAN tags are used to trick the switch into forwarding the frame to a different VLAN. Since Private VLANs rely on the switch to filter inter-port traffic based on VLAN membership, successfully hopping to another VLAN bypasses those port-level controls. This makes VLAN hopping the correct answer for a technique that directly defeats Private VLAN isolation.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 185 original PT0-003 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.