SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
During troubleshooting, several hosts in VLAN 20 lose access to the default gateway at random. Their ARP caches now map the gateway IP to a workstation MAC address, and traffic briefly flows through that workstation before timing out. What attack is most likely?
⚠ Common exam trap
CompTIA often tests ARP poisoning by describing symptoms of gateway loss and ARP cache corruption, and the trap here is that candidates may confuse it with DNS poisoning because both involve redirection, but ARP poisoning operates at Layer 2 (MAC address) while DNS poisoning operates at Layer 7 (name resolution).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ARP poisoning, because false ARP replies are redirecting gateway traffic to another host.
The scenario describes classic ARP poisoning (also known as ARP spoofing). The attacker sends forged ARP replies to the hosts in VLAN 20, associating the gateway's IP address with the attacker's MAC address. This causes the hosts to forward traffic destined for the gateway to the attacker's workstation, where it is briefly forwarded (or dropped) before timing out, matching the symptoms of a man-in-the-middle attack via ARP cache corruption.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
DNS poisoning, because the workstation name may be resolving to the wrong IP address.
Why it's wrong here
DNS poisoning is a name-resolution attack where an attacker corrupts a DNS server or resolver cache so a hostname resolves to an incorrect IP address. However, the symptom described involves the ARP cache on hosts in VLAN 20 mapping the gateway IP to a wrong MAC address, which is a layer-2 data-link-layer issue. DNS poisoning would not alter ARP entries, and even if DNS were fully functional, the traffic would still be sent to the attacker's MAC address. Thus, the misdirection is occurring at the ARP level, not the DNS level.
- ✓
ARP poisoning, because false ARP replies are redirecting gateway traffic to another host.
Why this is correct
ARP poisoning occurs when an attacker sends unsolicited ARP replies or gratuitous ARP messages on the local subnet, causing victim hosts to associate the gateway IP with the attacker's MAC address. This redirects traffic intended for the default gateway to the attacker's machine, enabling interception, man-in-the-middle attacks, or intentional disruption of connectivity. In VLAN 20, all hosts share the same broadcast domain, making them vulnerable to such layer-2 attacks. The observed symptom of lost access directly matches the poisoned ARP cache, making this the correct root cause.
- ✗
Replay attack, because the attacker is reusing old network frames to confuse the hosts.
Why it's wrong here
A replay attack involves capturing legitimate network frames and retransmitting them at a later time to trick a system into accepting a duplicated action, such as replaying a login or a financial transaction. In this scenario, the hosts lose access because their ARP tables have been intentionally corrupted with false gateway MAC mappings, not because old frames are being replayed. Replayed frames would not cause the ARP cache to update to an incorrect MAC address; they would merely duplicate existing traffic. Thus, the evidence of a poisoned ARP table distinguishes this from a replay attack.
- ✗
Denial of service, because traffic eventually times out and connectivity is lost.
Why it's wrong here
Although ARP poisoning ultimately leads to a denial of service because traffic cannot be delivered correctly, simply labeling the issue as DoS overlooks the specific mechanism responsible for the outage. The question explicitly indicates that hosts in VLAN 20 are losing access due to false ARP replies that map the gateway IP to the wrong MAC address, which is a deliberate layer-2 attack. A denial of service could result from many causes, such as resource exhaustion or network flooding, but here the timestamps and traffic analysis point to ARP cache manipulation as the root cause. Therefore, DoS is a consequence, not the root cause.
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Man-in-the-Middle Attacks
Key term
ARP
Address Resolution Protocol (ARP) is a network protocol used to map a device's IP address to its physical MAC address so data can be delivered correctly on a local network.
Key term
Default gateway
A default gateway is a network device, typically a router, that acts as the exit point for traffic from a local network to other networks, including the internet.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.