CEH Practice Question: Advanced Topics: Wireless, Cloud, IoT, Cryptography
A security analyst captures network traffic and sees multiple ARP packets with the same source MAC address but different IP addresses. Which attack is MOST likely occurring?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ARP spoofing attack
An evil twin attack involves a rogue AP impersonating a legitimate one, but it does not typically cause ARP packets with varied IPs. ARP spoofing involves an attacker sending forged ARP replies to associate their MAC with another IP, causing traffic to be misdirected. The described behavior matches ARP spoofing, where the attacker's MAC appears with multiple IPs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
WPS PIN attack
Why it's wrong here
A WPS PIN attack specifically targets the Wi-Fi Protected Setup (WPS) protocol, which is designed to simplify wireless network setup. Attackers attempt to brute-force the 8-digit WPS PIN, often exploiting a design flaw that allows the PIN to be validated in two halves. This attack aims to recover the network's pre-shared key (PSK) or passphrase, enabling unauthorized access to the Wi-Fi network, but it operates at the application layer of the WPS protocol and does not involve the manipulation or capture of Address Resolution Protocol (ARP) packets.
- ✗
De-authentication attack
Why it's wrong here
A de-authentication attack is a type of denial-of-service (DoS) attack against wireless networks, where an attacker sends forged de-authentication frames to one or more clients, or to the access point (AP) itself, impersonating the AP or the client. These frames instruct the target device to disconnect from the wireless network, effectively forcing legitimate users offline. This attack operates at the data link layer (specifically 802.11 management frames) and does not involve the Address Resolution Protocol (ARP) for its execution.
- ✗
Evil twin attack
Why it's wrong here
An evil twin attack involves setting up a rogue wireless access point (AP) that mimics a legitimate one, often by using the same Service Set Identifier (SSID) and appearing to offer a stronger signal. The attacker's goal is to trick unsuspecting users into connecting to the malicious AP, allowing the attacker to intercept their network traffic, capture credentials, or inject malware. While highly effective for man-in-the-middle (MitM) scenarios, this attack primarily operates by impersonating a Wi-Fi network and does not directly involve the manipulation or capture of Address Resolution Protocol (ARP) packets on an existing wired or wireless network segment.
- ✓
ARP spoofing attack
Why this is correct
ARP spoofing, also known as ARP poisoning, is a man-in-the-middle (MitM) attack where an attacker sends forged Address Resolution Protocol (ARP) messages over a local area network. The attacker's goal is to associate their own MAC address with the IP address of another host, such as the default gateway, or to associate the gateway's MAC address with the victim's IP. By doing so, the attacker intercepts network traffic intended for other devices, as the traffic is incorrectly routed through the attacker's machine, allowing for eavesdropping, modification, or redirection. This directly involves manipulating ARP packets to link a single MAC address to multiple IP addresses or vice-versa within the victim's ARP cache.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.