CEH Practice Question: Malware, Social Engineering and Network Attacks
A security team observes that a switch's MAC address table is full, and the switch has started flooding unicast traffic to all ports. Which attack has MOST likely been performed?
⚠ Common exam trap
A common mix-up: candidates confuse MAC flooding (which targets the switch's CAM table) with ARP poisoning (which targets host ARP caches), as both involve MAC addresses and can lead to traffic interception, but they operate at different layers and use different mechanisms.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
MAC flooding
MAC flooding attacks exploit the limited size of a switch's CAM (Content Addressable Memory) table. By sending thousands of frames with random source MAC addresses, the attacker fills the table to capacity. Once full, the switch enters a fail-open state and begins flooding all unknown unicast traffic out every port, effectively turning it into a hub and allowing the attacker to capture traffic not destined for them.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
MAC flooding
Why this is correct
MAC flooding is an attack technique that overwhelms a network switch's Content Addressable Memory (CAM) table with a massive number of unique, fake MAC address-to-port mappings. By sending numerous Ethernet frames, each with a different spoofed source MAC address, the attacker forces the CAM table to fill up completely. Once the CAM table is full, the switch can no longer store new MAC-to-port associations and reverts to acting like a hub, broadcasting all incoming traffic out of every port. This allows an attacker to capture and analyze traffic intended for other devices on the network segment.
- ✗
ARP poisoning
Why it's wrong here
ARP poisoning, also known as ARP spoofing, involves an attacker sending forged Address Resolution Protocol (ARP) messages onto a local area network. The goal is to associate the attacker's MAC address with the IP address of another host, such as the default gateway, in the ARP caches of other devices. This manipulation redirects network traffic through the attacker's machine, enabling man-in-the-middle attacks, but it does not directly target or overflow the switch's MAC address table itself.
- ✗
MAC spoofing
Why it's wrong here
MAC spoofing is the act of changing a network interface controller's (NIC) factory-assigned Media Access Control (MAC) address to a different, chosen MAC address. This technique is often used to bypass MAC-based access controls, impersonate another device, or hide the true identity of a system on a network. Unlike MAC flooding, which aims to fill a switch's table with many entries, MAC spoofing typically involves changing only a single MAC address on an attacker's own device.
- ✗
DHCP starvation
Why it's wrong here
DHCP starvation is a denial-of-service attack where an attacker rapidly sends a large number of DHCP DISCOVER requests with spoofed MAC addresses to a DHCP server. The objective is to exhaust the entire pool of available IP addresses that the DHCP server can assign. Once the legitimate IP address pool is depleted, new legitimate clients cannot obtain an IP address, effectively denying them network access, but this attack does not directly interact with or impact a switch's MAC address table.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.