SY0-701 Security Operations Practice Question
A network analyst reviews packet captures from a subnet where users intermittently lose access to the gateway. Which two findings would most strongly indicate ARP spoofing? Select two.
⚠ Common exam trap
CompTIA often tests the distinction between ARP spoofing (unsolicited ARP replies) and ARP cache poisoning (where the attacker responds faster than the legitimate host), and candidates may confuse extra DNS traffic or physical issues with ARP-based attacks.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Repeated unsolicited ARP replies map the gateway IP to a different MAC address.
ARP spoofing involves an attacker sending forged ARP replies to associate the gateway's IP address with the attacker's MAC address. Repeated unsolicited ARP replies mapping the gateway IP to a different MAC address is a classic indicator, as legitimate ARP replies are normally solicited by requests. This causes traffic intended for the gateway to be redirected to the attacker, enabling interception or disruption.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Repeated unsolicited ARP replies map the gateway IP to a different MAC address.
Why this is correct
Repeated unsolicited ARP replies are a classic sign of spoofing on a LAN. In normal operation, hosts send ARP replies only in response to requests; a gratuitous ARP reply announcing the gateway IP with an attacker's MAC address forces all hosts to update their ARP cache to that malicious mapping. This lets the attacker intercept or modify traffic intended for the gateway, enabling man-in-the-middle attacks.
- ✓
Several hosts suddenly send gateway traffic to the same unexpected MAC address.
Why this is correct
Multiple hosts sending gateway traffic to a single unexpected MAC address is a strong indicator of ARP cache poisoning. When an attacker sends spoofed ARP replies to all devices, they each update their cache simultaneously, causing a sudden shift in traffic flow to the same rogue MAC. The unexpected MAC can be verified against vendor databases, and its presence across many hosts confirms an active spoof, not a misconfiguration.
- ✗
Extra DNS traffic appears during the lunch hour.
Why it's wrong here
Extra DNS traffic during lunch hour is unrelated to gateway MAC mapping issues. DNS operates at the application layer and resolves domain names to IP addresses, not IP addresses to MAC addresses; ARP handles link-layer addressing. Increased DNS queries could stem from routine web browsing, networked applications, or background updates, but they do not indicate ARP spoofing or poisoning.
- ✗
A switch port negotiates a slower speed than usual.
Why it's wrong here
A switch port negotiating a slower speed usually indicates a physical layer problem, such as a damaged cable, cross-talk, or an interface that failed to auto-negotiate properly. This issue is unrelated to the gateway IP-to-MAC mapping; ARP operates at the data link layer above the physical signaling. A speed change will not cause gateway traffic to be redirected to an unexpected MAC address.
- ✗
The wireless network name appears in a site survey.
Why it's wrong here
The appearance of a wireless network name in a site survey simply indicates that a wireless access point is broadcasting its SSID, which is normal for both legitimate and rogue access points. However, a site survey reveals radio-frequency information and SSIDs, not ARP cache mappings or gateway MAC addresses. Therefore, it has no bearing on the observed ARP spoofing behavior described in the capture.
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Identity and Access Management
Key term
MAC
MAC (Media Access Control) is a unique hardware identifier assigned to network interfaces for communication on a local network segment.
Key term
ARP
Address Resolution Protocol (ARP) is a network protocol used to map a device's IP address to its physical MAC address so data can be delivered correctly on a local network.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.