Courseiva
Malware, Social Engineering and Network AttacksmediumMultiple ChoiceObjective-mapped

CEH Practice Question: Malware, Social Engineering and Network Attacks

A penetration tester uses a tool to perform a man-in-the-middle attack by sending forged DNS responses that redirect users to a malicious website. Which tool is MOST likely being used to perform DNS spoofing?

⚠ Common exam trap

Watch out — candidates often confuse packet capture tools (Wireshark, tcpdump) with active attack tools, forgetting that DNS spoofing requires injecting forged packets, not just passive observation.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

Ettercap

Ettercap is a comprehensive suite for man-in-the-middle attacks, including ARP poisoning and DNS spoofing. It can intercept DNS requests and forge fake responses to redirect victims to a malicious IP, making it the correct tool for DNS spoofing.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • Nmap

    Why it's wrong here

    Nmap (Network Mapper) is primarily a powerful open-source tool for network discovery and security auditing. Its core functionalities include host discovery, port scanning, service version detection, and operating system identification, which are crucial for reconnaissance phases. However, Nmap does not possess the capabilities for active packet injection, ARP cache poisoning, or DNS response manipulation required to establish and maintain a Man-in-the-Middle position. It gathers information about network topology and services, rather than intercepting or altering live traffic flows.

  • Wireshark

    Why it's wrong here

    Wireshark is a widely used graphical network protocol analyzer designed for passive traffic inspection and troubleshooting. It allows users to capture and interactively browse the data flowing on a network, providing deep insight into individual packets and protocol details. While invaluable for analyzing the effects of a Man-in-the-Middle attack or understanding network communications, Wireshark is strictly a monitoring tool. It cannot actively inject spoofed packets, perform ARP poisoning, or modify DNS responses to facilitate an interception attack.

  • Ettercap

    Why this is correct

    Ettercap is a comprehensive and versatile suite specifically designed for Man-in-the-Middle attacks on switched LANs. It excels by implementing robust ARP spoofing to redirect traffic between two hosts through the attacker's machine, effectively placing itself in the middle. Beyond simple interception, Ettercap includes powerful plugins for active manipulation, such as DNS spoofing, content filtering, and packet injection, making it a primary tool for intercepting, analyzing, and altering network communications in real-time. Its integrated framework directly supports the actions needed for a successful MITM attack.

  • tcpdump

    Why it's wrong here

    tcpdump is a command-line packet analyzer that allows users to capture and display TCP/IP and other packets transmitted or received over a network interface. It is a fundamental tool for network monitoring, debugging, and security analysis, providing raw packet data for inspection. However, tcpdump is inherently a passive listening tool, designed solely for capturing and analyzing network traffic. It lacks any built-in functionality to actively craft and inject spoofed packets, perform ARP cache poisoning, or manipulate DNS queries, which are essential for executing a Man-in-the-Middle attack.

About these practice questions

Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.