SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
Users on a branch VLAN intermittently reach a fake login page even though DNS records have not changed. A packet capture shows the default gateway MAC address changing every 60 seconds, and the switch logs list repeated unsolicited ARP replies from one workstation. Which attack is most likely?
⚠ Common exam trap
The trap here is that candidates see 'fake login page' and 'DNS records have not changed' and jump to DNS poisoning, but the key indicator is the MAC address changing every 60 seconds, which is a classic sign of ARP poisoning, not DNS manipulation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ARP poisoning, because forged ARP replies are associating the gateway IP with the attacker's MAC address.
The repeated unsolicited ARP replies from one workstation, combined with the default gateway MAC address changing every 60 seconds, directly indicate an ARP poisoning attack. The attacker is sending forged ARP replies to associate the gateway IP with its own MAC address, causing traffic destined for the gateway to be intercepted. This allows the attacker to redirect users to a fake login page without altering DNS records.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
DNS poisoning, because name resolution is directing users to the wrong server.
Why it's wrong here
DNS poisoning operates at the name-resolution layer, where an attacker alters DNS records or responses to map a legitimate hostname to a malicious IP address. On a switched LAN, a poisoned DNS cache would consistently redirect the victim to a different IP while leaving the gateway MAC address and ARP cache unchanged. The observed repeated unsolicited ARP replies and changing gateway MAC clearly indicate manipulation of IP-to-MAC bindings at Layer 2, not the hostname-to-IP mapping that DNS resolves.
- ✓
ARP poisoning, because forged ARP replies are associating the gateway IP with the attacker's MAC address.
Why this is correct
ARP poisoning is the best fit because the attacker is sending unsolicited ARP replies to rewrite the local IP-to-MAC mapping. The changing gateway MAC address and repeated ARP activity are classic signs of a man-in-the-middle setup on a switched LAN. Once traffic is redirected through the attacker, fake login pages and credential interception become possible.
- ✗
Replay attack, because previously captured traffic is being resent to the network.
Why it's wrong here
Replay attacks capture and retransmit legitimate packets (such as authentication tokens, Kerberos tickets, or past transactions) to impersonate a user or repeat an action; they do not modify local network addressing. In this scenario, the attacker is actively rewriting the gateway IP-to-MAC mapping so that live traffic is redirected through the attacker's NIC, which enables the fake login page injection. The traffic is not a resent copy of previously captured data but rather fresh traffic being intercepted via forged ARP replies, which is why replay does not explain the changing gateway MAC or unsolicited ARP activity.
- ✗
Denial of service, because the branch users cannot reliably reach websites.
Why it's wrong here
A denial-of-service attack is designed to make a service or network unusable through resource exhaustion, flooding, or crashing the switch or gateway, leading to no connectivity at all. Here users are still reaching websites but are intermittently redirected to a fake login page, indicating an active man-in-the-middle interception rather than an outage. ARP cache entries expire and refresh on a timer, which explains the intermittent redirection, whereas DoS would cause persistent unavailability or complete lack of communication, not selective traffic injection with login credential harvesting.
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Watering Hole Attacks
Key term
ARP poisoning
ARP poisoning is a network attack where an attacker sends fake Address Resolution Protocol messages to link their MAC address with a legitimate IP address, enabling them to intercept, modify, or stop data on a local network.
Key term
Default gateway
A default gateway is a network device, typically a router, that acts as the exit point for traffic from a local network to other networks, including the internet.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.