CEH Practice Question: Malware, Social Engineering and Network Attacks
A security team suspects a session hijacking attack. The analyst examines network traffic and sees packets with sequence numbers that increment by predictable values. Which attack is MOST likely occurring?
⚠ Common exam trap
Many exam-takers confuse session hijacking with ARP poisoning or DNS spoofing, but the key clue is 'predictable sequence numbers,' which directly points to TCP sequence prediction, not Layer 2 or DNS manipulation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
TCP sequence prediction
TCP sequence prediction attacks exploit the ability to guess the next sequence number in a TCP connection, allowing an attacker to inject forged packets and hijack the session. The analyst observed packets with sequence numbers incrementing by predictable values, which is the hallmark of weak or static sequence number generation in older TCP implementations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
TCP sequence prediction
Why this is correct
TCP sequence prediction involves an attacker guessing the next valid sequence number in a TCP connection. If the sequence numbers are predictable, the attacker can inject crafted packets into an established session, effectively hijacking it. By successfully predicting and sending packets with the correct sequence and acknowledgment numbers, the attacker can impersonate one of the legitimate communication parties, taking control of the session without needing to intercept initial authentication. This allows for unauthorized command execution or data manipulation within the active session.
- ✗
ARP poisoning
Why it's wrong here
ARP poisoning, or ARP spoofing, involves an attacker sending forged Address Resolution Protocol (ARP) messages onto a local area network. This manipulates the MAC address tables of other devices, causing them to associate the attacker's MAC address with the IP address of a legitimate host, such as the default gateway. While this enables a man-in-the-middle attack to intercept traffic, it primarily focuses on redirecting network flow rather than directly taking over an established TCP session by guessing its state parameters.
- ✗
DNS spoofing
Why it's wrong here
DNS spoofing, also known as DNS cache poisoning, involves an attacker injecting forged DNS resource records into a DNS resolver's cache or directly responding to DNS queries with malicious information. This causes users attempting to access a legitimate website to be redirected to an attacker-controlled server instead. While it can lead to credential theft or malware distribution, DNS spoofing primarily targets the name resolution process and does not directly involve taking over an already established TCP session between two communicating parties.
- ✗
MAC flooding
Why it's wrong here
MAC flooding is an attack where an attacker sends a large number of frames with unique source MAC addresses to a network switch. This overwhelms the switch's Content Addressable Memory (CAM) table, causing it to fill up with bogus entries. Once the CAM table is full, the switch enters a "fail-open" mode, behaving like an Ethernet hub by broadcasting all incoming traffic out of every port. While this allows an attacker to sniff all network traffic, it does not directly facilitate taking control of an existing TCP session by manipulating its state or sequence numbers.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.