SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
After a switch reboot in a conference room, several laptops obtain valid IP addresses in the correct subnet, but their default gateway changes to 10.20.40.50, which is not the legitimate router. Packet capture shows DHCP offers coming from a MAC address that does not belong to the approved DHCP server, and the rogue device responds faster than the real server. What attack is most likely occurring?
⚠ Common exam trap
A common mix-up: candidates confuse the symptom (wrong gateway) with ARP poisoning or DNS attacks, but the key clue is the DHCP offer source and the faster response time, which uniquely identifies a rogue DHCP server.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Rogue DHCP service, because an unauthorized DHCP server is handing out network settings.
The scenario describes an unauthorized device responding to DHCP discovery messages faster than the legitimate server, assigning valid IPs but a rogue default gateway (10.20.40.50). This is the classic behavior of a rogue DHCP server, which intercepts DHCP traffic to manipulate client network settings, enabling man-in-the-middle attacks. The packet capture confirming DHCP offers from an unknown MAC address directly identifies the attack as a Rogue DHCP service.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
ARP poisoning, because the attacker is changing IP-to-MAC mappings on the local network.
Why it's wrong here
ARP poisoning specifically corrupts the Layer 2 IP-to-MAC resolution table on hosts or switches, allowing an attacker to intercept traffic after it has been addressed. In this scenario, the laptops are being assigned a wrong default gateway directly from a forged DHCP offer, so they never even attempt to resolve the legitimate gateway's IP because their IP stack is already misconfigured by the rogue server. The attack occurs during initial network configuration, before ARP lookups are made, so ARP poisoning is not the immediate mechanism causing the observed symptoms.
- ✓
Rogue DHCP service, because an unauthorized DHCP server is handing out network settings.
Why this is correct
A rogue DHCP service is the best answer. The clients receive valid-looking leases from an unauthorized device, and the device supplies the default gateway before the legitimate server can respond. This is a common and dangerous network attack because it can redirect traffic, enable interception, or break connectivity without requiring packet spoofing at the ARP layer.
- ✗
Replay attack, because the attacker is reusing old DHCP offers.
Why it's wrong here
A replay attack involves capturing legitimate DHCP messages and retransmitting them later to trick clients into accepting stale or previously used offers. This scenario describes an active rogue DHCP server that responds to the laptops' DHCP DISCOVER requests in real time, handing out a malicious default gateway rather than reusing a previously seen offer. The switch reboot causes clients to renew their leases, which creates an opportunity for an unauthorized server to inject its own fresh DHCP responses, not for an attacker to replay old ones.
- ✗
DNS poisoning, because the clients are being sent to the wrong network path.
Why it's wrong here
DNS poisoning alters name resolution to misdirect clients to malicious hostnames or addresses. Here the wrong default gateway is being assigned directly by a fake DHCP server, so the issue is earlier in the network configuration process.
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Social Engineering Attacks
Key term
IPS
An Intrusion Prevention System (IPS) is a network security device that monitors traffic in real time and automatically blocks threats before they reach your systems.
Key term
DHCP
Dynamic Host Configuration Protocol (DHCP) automatically assigns IP addresses and network settings to devices on a network, so they can communicate without manual configuration.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.