SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  ARP poisoning

  Why this is correct

  ARP poisoning is a Layer 2 attack that exploits the lack of authentication in the Address Resolution Protocol. An attacker on the same subnet sends forged ARP replies, associating the default gateway IP address with the attacker's MAC address. Victims update their ARP cache incorrectly, so all outbound traffic intended for the gateway is sent to the attacker's device. This causes intermittent connectivity as the attacker may drop, delay, or forward frames selectively, and the unusual ARP traffic would be visible in packet captures.

• ✗

  DNS cache poisoning

  Why it's wrong here

  DNS cache poisoning corrupts the translation of domain names to IP addresses at the application layer, often by injecting malicious DNS records into a resolver's cache. It does not affect the Layer 2 ARP mappings that determine how hosts on the same subnet communicate with the gateway. Since the problem is isolated to one subnet, a DNS issue would not selectively impact those users' connectivity while leaving other subnet traffic unaffected. A capture would show manipulated DNS responses, not a flood of forged ARP replies.

• ✗

  Replay attack

  Why it's wrong here

  A replay attack involves intercepting and later retransmitting a valid data transmission, such as an authentication token or a signed transaction, to reproduce an action. It targets the integrity or replay protection of higher-layer protocols and does not alter the network's MAC-to-IP mappings. In this scenario, users experience intermittent loss of local connectivity, which is a Layer 2 problem; replay attacks would not change ARP caches or interfere with normal frame forwarding. The packet capture would show repeated identical packets, not unsolicited ARP replies.

• ✗

  Amplification attack

  Why it's wrong here

  An amplification attack is a volumetric DDoS technique where an attacker sends a small query to a public server with a spoofed source IP, causing that server to send a large response to the victim. It relies on reflected UDP traffic from external services, such as DNS or NTP, and originates outside the victim's local subnet. Such an attack would flood the network link but would not compromise the ARP cache or cause specific MAC-addressed frames to be misrouted. The capture would show high-volume reflected traffic from external IPs, not local ARP poisoning behavior.