SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
Users on a wired subnet report intermittent outages when reaching an internal application. A packet capture shows the default gateway IP address repeatedly mapped to a different workstation MAC address, and traffic is being forwarded through that workstation. What attack is most likely occurring?
⚠ Common exam trap
A common mix-up: candidates confuse ARP spoofing with DNS poisoning because both involve redirecting traffic, but ARP spoofing operates at Layer 2 (MAC address manipulation) while DNS poisoning operates at Layer 7 (hostname resolution).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ARP spoofing, because false Layer 2 address mappings are redirecting traffic.
B is correct because ARP spoofing (also known as ARP poisoning) involves an attacker sending forged ARP messages over a local area network. This results in the attacker's MAC address being associated with the IP address of the default gateway, causing traffic destined for the gateway to be forwarded to the attacker's workstation instead. The packet capture evidence of the default gateway IP repeatedly mapped to a different workstation MAC address is the classic signature of this attack.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
DNS poisoning, because the hostname is resolving to the wrong server.
Why it's wrong here
DNS poisoning corrupts name resolution, causing a hostname to resolve to an attacker-controlled IP address. The evidence here involves repeated ARP replies that map the gateway's IP to a workstation's MAC address on Layer 2, not DNS records. Since the gateway is accessed by IP (or its name already resolves correctly), the redirection is occurring at the address resolution protocol layer, not via altered DNS responses. Thus, DNS poisoning is not the correct explanation.
- ✓
ARP spoofing, because false Layer 2 address mappings are redirecting traffic.
Why this is correct
ARP spoofing, also called ARP poisoning, happens when a host sends forged ARP messages that associate a target IP address with the attacker’s MAC address. In this case, the gateway IP is repeatedly being mapped to a workstation MAC, and traffic is being relayed through that workstation. That is a classic man-in-the-middle setup on a local network segment.
- ✗
Replay attack, because packets are being resent to the gateway.
Why it's wrong here
A replay attack captures legitimate packets (e.g., authentication tokens, secure transactions) and retransmits them to trick a receiver into thinking they are fresh. The symptom described is intermittent loss of connectivity caused by forged ARP messages that bind the gateway IP to a workstation MAC, actively redirecting traffic. There is no reuse of captured data; the attacker is injecting new, malicious ARP replies to manipulate the MAC-to-IP mapping. Therefore, replay is not the right classification.
- ✗
Rogue DHCP service, because clients are losing access to the default gateway.
Why it's wrong here
A rogue DHCP server would distribute incorrect IP configurations, such as a wrong default gateway or DNS server, to clients, causing them to lose proper network access. In the capture, the actual issue is forged ARP replies from a workstation claiming to be the gateway, which intercepts traffic on an existing, functioning subnet. Clients are not being given bad DHCP leases; their ARP caches are being poisoned, so the default gateway's IP maps to the attacker's MAC. Hence, rogue DHCP does not explain the evidence.
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Application Attacks: SQL Injection, XSS
Key term
Subnet
A subnet is a logical subdivision of an IP network, created by partitioning a larger network address space using subnet masks.
Key term
MAC
MAC (Media Access Control) is a unique hardware identifier assigned to network interfaces for communication on a local network segment.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.