CEH Practice Question: Malware, Social Engineering and Network Attacks
A network switch starts behaving like a hub, broadcasting all traffic to all ports. The security team suspects an attack that floods the switch with fake MAC addresses. Which attack is this?
⚠ Common exam trap
EC-Council often tests the distinction between MAC flooding (layer 2 CAM table exhaustion) and ARP poisoning (layer 2/3 cache manipulation), so candidates mistakenly choose ARP poisoning because both involve MAC addresses, but only MAC flooding causes the switch to broadcast traffic like a hub.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
MAC flooding
MAC flooding exploits the limited size of a switch's Content Addressable Memory (CAM) table. By sending thousands of packets with unique, fake source MAC addresses, the attacker fills the CAM table, forcing the switch to fail open and broadcast all incoming frames to every port, effectively behaving like a hub. This allows the attacker to capture traffic not originally destined for their port.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
MAC flooding
Why this is correct
MAC flooding involves overwhelming a switch's Content Addressable Memory (CAM) table (also known as MAC address table) with a multitude of forged source MAC addresses. When the CAM table becomes full, the switch can no longer store new legitimate MAC-to-port mappings. Consequently, for any new incoming frames destined for an unknown MAC address, the switch resorts to broadcasting the frames out of all ports, effectively degrading its functionality to that of a network hub. This allows an attacker to capture traffic intended for other hosts on the segment.
- ✗
ARP poisoning
Why it's wrong here
ARP poisoning involves sending forged Address Resolution Protocol (ARP) messages over a local area network. Its primary goal is to link an attacker's MAC address with the IP address of another legitimate host, such as a default gateway, within the victim's ARP cache. While this allows an attacker to intercept, modify, or stop traffic between two hosts, it does not directly cause the network switch itself to broadcast all traffic to all ports; the switch's CAM table remains unaffected by ARP cache manipulation.
- ✗
STP attack
Why it's wrong here
A Spanning Tree Protocol (STP) attack involves manipulating the STP to force a switch to become the root bridge or to create a forwarding loop. Attackers achieve this by sending superior Bridge Protocol Data Units (BPDUs) to influence the STP topology. While successful STP attacks can disrupt network availability, cause traffic redirection, or create denial-of-service conditions by introducing loops, they do not inherently cause a switch to broadcast all incoming frames to every port as a hub would.
- ✗
DNS spoofing
Why it's wrong here
DNS spoofing, also known as DNS cache poisoning, involves an attacker injecting forged DNS records into a DNS resolver's cache. This redirects users attempting to access legitimate websites to malicious sites controlled by the attacker, often for phishing or malware distribution. This attack operates at the application layer (Layer 7) and manipulates name resolution, having no direct impact on the fundamental Layer 2 forwarding behavior of a network switch or its CAM table, thus it cannot make a switch behave like a hub.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.