CEH Practice Question: Malware, Social Engineering and Network Attacks
A security administrator notices that the network switch is broadcasting traffic to all ports as if it were a hub. The switch logs show a sudden flood of packets with random MAC addresses. Which attack is MOST likely occurring?
⚠ Common exam trap
Many exam-takers confuse MAC flooding with ARP poisoning because both involve MAC addresses, but MAC flooding targets the switch's CAM table at Layer 2, while ARP poisoning manipulates IP-to-MAC mappings at Layer 3.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
MAC flooding
B is correct because MAC flooding attacks exploit the limited size of a switch's Content Addressable Memory (CAM) table. By sending a flood of packets with random source MAC addresses, the attacker fills the CAM table, forcing the switch to fail-open into hub mode (broadcasting all traffic to all ports) so that the attacker can capture frames not originally destined for their port.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SYN flood
Why it's wrong here
A SYN flood is a denial-of-service attack that exploits the TCP three-way handshake by sending numerous SYN requests to a target server without completing the connection. This exhausts the server's connection table, preventing legitimate users from establishing new sessions. While it impacts server availability, a SYN flood does not directly manipulate or alter the operational mode or forwarding logic of a network switch itself.
- ✓
MAC flooding
Why this is correct
MAC flooding overwhelms a network switch's Content Addressable Memory (CAM) table by rapidly sending frames with unique, spoofed source MAC addresses. When the CAM table, which stores MAC-to-port mappings, becomes full, the switch can no longer learn new addresses and reverts to broadcasting all incoming frames out of every port within the VLAN. This effectively transforms the switch into a hub-like device, allowing an attacker to intercept traffic intended for other hosts.
- ✗
ARP poisoning
Why it's wrong here
ARP poisoning, also known as ARP spoofing, is a man-in-the-middle attack where an attacker sends forged Address Resolution Protocol (ARP) messages to associate their MAC address with the IP address of another legitimate host, such as the default gateway. This manipulates the ARP caches of affected hosts, redirecting traffic through the attacker. However, ARP poisoning targets host ARP tables and does not directly attack or alter the internal CAM table or forwarding behavior of a network switch.
- ✗
DNS amplification
Why it's wrong here
DNS amplification is a reflection-based distributed denial-of-service (DDoS) attack that leverages open DNS resolvers to flood a victim with a massive volume of traffic. Attackers send small DNS queries with a spoofed source IP address (the victim's) to numerous DNS servers, which then respond with much larger replies directed at the victim. This attack primarily targets network bandwidth and server resources, having no direct impact on the operational state or security mechanisms of a network switch.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.