CEH Practice Question: Malware, Social Engineering and Network Attacks
A security analyst uses a tool to capture packets in promiscuous mode on a network segment. The analyst notices that only traffic to and from the analyst's machine is captured, not all traffic on the segment. What is the most likely reason?
⚠ Common exam trap
Test-takers frequently assume promiscuous mode guarantees capturing all network traffic, forgetting that promiscuous mode only affects the NIC's filtering of frames it receives, not what frames the switch delivers to that port.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The network is using a switch instead of a hub
A switch forwards frames only to the specific port associated with the destination MAC address, unlike a hub which floods all traffic to every port. When a security analyst captures packets in promiscuous mode on a switch, the NIC can see only the frames destined for or originating from that port, plus broadcast/multicast frames. Therefore, the most likely reason only traffic to/from the analyst's machine is captured is that the network uses a switch, not a hub.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The network is using a switch instead of a hub
Why this is correct
A network switch operates at Layer 2 (Data Link Layer) and intelligently forwards frames only to the specific port associated with the destination MAC address. Unlike a hub, which broadcasts all traffic to every connected port, a switch isolates traffic flows. Therefore, even if an analyst's network interface is in promiscuous mode, it will only receive broadcast traffic, multicast traffic it has joined, and unicast traffic specifically destined for its own MAC address, making passive sniffing of other hosts' unicast traffic impossible without additional active techniques like port mirroring or ARP poisoning.
- ✗
The switch is preventing sniffing due to port security
Why it's wrong here
Port security is a Layer 2 security feature designed to restrict input to an interface by limiting the number of valid MAC addresses allowed on a port. While it can prevent unauthorized devices from connecting or limit MAC address spoofing, it does not inherently prevent a legitimate device from receiving traffic destined for other hosts if that traffic were to be forwarded to its port. The fundamental reason sniffing fails on a switch is its intelligent forwarding mechanism, not specifically port security, which addresses different security concerns.
- ✗
The analyst is not using the correct filter in Wireshark
Why it's wrong here
Wireshark filters primarily affect how captured packets are displayed or stored after they have already been received by the network interface. A display filter, for instance, merely hides packets from view; it does not prevent them from being captured. If the target traffic is not reaching the analyst's network interface card (NIC) due to the switch's intelligent forwarding, no filter, regardless of its correctness, can make that traffic appear or be captured.
- ✗
The network interface is not in promiscuous mode
Why it's wrong here
Promiscuous mode instructs a network interface card (NIC) to accept all frames it receives, regardless of whether they are addressed to its own MAC address. While essential for capturing traffic not directly destined for the sniffing host, promiscuous mode alone is insufficient on a switched network. A switch's intelligent forwarding ensures that only traffic intended for the sniffing host's port (broadcasts, multicasts, or its own unicast traffic) is sent there, meaning promiscuous mode cannot overcome the physical isolation imposed by the switch.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.