CEH Practice Question: Malware, Social Engineering and Network Attacks
A penetration tester uses a tool to perform a man-in-the-middle attack by sending forged DNS responses that redirect users to a malicious website. Which tool is MOST likely being used to perform DNS spoofing?
⚠ Common exam trap
Watch out — candidates often confuse packet capture tools (Wireshark, tcpdump) with active attack tools, forgetting that DNS spoofing requires injecting forged packets, not just passive observation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Ettercap
Ettercap is a comprehensive suite for man-in-the-middle attacks, including ARP poisoning and DNS spoofing. It can intercept DNS requests and forge fake responses to redirect victims to a malicious IP, making it the correct tool for DNS spoofing.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Nmap
Why it's wrong here
Nmap (Network Mapper) is primarily a powerful open-source tool for network discovery and security auditing. Its core functionalities include host discovery, port scanning, service version detection, and operating system identification, which are crucial for reconnaissance phases. However, Nmap does not possess the capabilities for active packet injection, ARP cache poisoning, or DNS response manipulation required to establish and maintain a Man-in-the-Middle position. It gathers information about network topology and services, rather than intercepting or altering live traffic flows.
- ✗
Wireshark
Why it's wrong here
Wireshark is a widely used graphical network protocol analyzer designed for passive traffic inspection and troubleshooting. It allows users to capture and interactively browse the data flowing on a network, providing deep insight into individual packets and protocol details. While invaluable for analyzing the effects of a Man-in-the-Middle attack or understanding network communications, Wireshark is strictly a monitoring tool. It cannot actively inject spoofed packets, perform ARP poisoning, or modify DNS responses to facilitate an interception attack.
- ✓
Ettercap
Why this is correct
Ettercap is a comprehensive and versatile suite specifically designed for Man-in-the-Middle attacks on switched LANs. It excels by implementing robust ARP spoofing to redirect traffic between two hosts through the attacker's machine, effectively placing itself in the middle. Beyond simple interception, Ettercap includes powerful plugins for active manipulation, such as DNS spoofing, content filtering, and packet injection, making it a primary tool for intercepting, analyzing, and altering network communications in real-time. Its integrated framework directly supports the actions needed for a successful MITM attack.
- ✗
tcpdump
Why it's wrong here
tcpdump is a command-line packet analyzer that allows users to capture and display TCP/IP and other packets transmitted or received over a network interface. It is a fundamental tool for network monitoring, debugging, and security analysis, providing raw packet data for inspection. However, tcpdump is inherently a passive listening tool, designed solely for capturing and analyzing network traffic. It lacks any built-in functionality to actively craft and inject spoofed packets, perform ARP cache poisoning, or manipulate DNS queries, which are essential for executing a Man-in-the-Middle attack.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.