SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
Exhibit
Network capture summary: Host 10.20.14.25 sends ARP requests for 10.20.14.1 Multiple ARP replies received: 10.20.14.1 is-at 02:42:ac:11:00:05 10.20.14.1 is-at 02:42:ac:11:00:05 10.20.14.1 is-at 66:77:88:99:aa:bb Client gateway cache alternates between the legitimate gateway MAC and 66:77:88:99:aa:bb every few seconds. Users report brief certificate warnings when opening internal sites.
Based on the exhibit, what network attack is most likely occurring on the office LAN?
⚠ Common exam trap
Many exam-takers confuse ARP poisoning with DNS poisoning because both involve false mappings, but ARP poisoning operates at layer 2 (MAC addresses) while DNS poisoning operates at the application layer (domain names), and the exhibit's focus on MAC address mappings clearly points to ARP.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ARP poisoning, because a rogue system is sending false layer 2 address mappings.
ARP poisoning is the correct answer because the exhibit shows a rogue system sending unsolicited ARP replies that map the gateway's IP address to the attacker's MAC address. This causes traffic destined for the gateway to be redirected to the attacker, enabling man-in-the-middle interception. The attack exploits the lack of authentication in ARP, allowing false layer 2 address mappings to corrupt the ARP cache of other hosts on the LAN.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
ARP poisoning, because a rogue system is sending false layer 2 address mappings.
Why this is correct
ARP poisoning is the best answer because the capture shows false ARP replies mapping the gateway IP to a different MAC address. The alternating gateway cache entries and certificate warnings are consistent with traffic being redirected through an attacker in a man-in-the-middle position.
- ✗
Replay attack, because the same ARP reply appears multiple times.
Why it's wrong here
A replay attack requires capturing legitimate authentication or transaction data and retransmitting it to trick a system into granting access or completing a duplicate action. Here, the repeated ARP replies are not replayed captured data; each frame is a fresh forged, unsolicited reply associating the gateway IP with the attacker's MAC address. The duplication is just the attacker re-poisoning the cache to override genuine entries, not a replay of an established valid exchange.
- ✗
Denial of service, because users notice certificate warnings.
Why it's wrong here
A denial of service attack is designed to exhaust resources, such as bandwidth, CPU, or memory, so that legitimate users cannot access a service. Certificate warnings in this exhibit are merely a symptom of the attacker's machine inserting itself into the TLS connection and presenting its own certificate, not evidence of a flood or outage. Since traffic is still flowing through the attacker to the intended destination, availability is not impaired; the attack compromises confidentiality and integrity via man-in-the-middle interception.
- ✗
DNS poisoning, because the users cannot reach internal sites cleanly.
Why it's wrong here
DNS poisoning corrupts name resolution data, such as A or AAAA records, causing a host to connect to a malicious IP address when it queries a domain name. The exhibit shows manipulation at the data-link layer, where the ARP cache is overwritten so that the gateway's IP maps to the attacker's MAC address; DNS resolution itself returns the correct IP. The 'cannot reach internal sites cleanly' symptom comes from the attacker intercepting and re-encrypting traffic, not from an incorrect DNS response, so DNS poisoning is the wrong layer of attack.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Network-Based Attacks
Key term
ARP
Address Resolution Protocol (ARP) is a network protocol used to map a device's IP address to its physical MAC address so data can be delivered correctly on a local network.
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.