CEH Practice Question: Malware, Social Engineering and Network Attacks
An attacker wants to perform a man-in-the-middle attack on a local network. Which two tools from the following list would be most effective? (Select the best answer from the options below; note: this is a multiple choice, not multi-select) A) Wireshark B) Ettercap C) Nmap D) Metasploit E) Aircrack-ng
⚠ Common exam trap
Candidates often confuse Nmap (a scanning tool) or Metasploit (an exploitation framework) as suitable for MITM attacks, but the classic MITM attack on a LAN uses ARP spoofing with Ettercap and packet capture with Wireshark.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Ettercap and Wireshark
Ettercap is a dedicated man-in-the-middle (MITM) tool that performs ARP spoofing to intercept traffic between hosts on a switched LAN. Wireshark captures and analyzes the intercepted packets, allowing the attacker to view unencrypted data. Together, they form the classic ARP poisoning attack chain: Ettercap redirects traffic, Wireshark inspects it.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Nmap and Metasploit
Why it's wrong here
Nmap and Metasploit are powerful tools for network reconnaissance and exploitation, respectively, but they do not directly facilitate a Man-in-the-Middle (MITM) attack. Nmap is primarily used for port scanning, service enumeration, and operating system detection, gathering information about targets. Metasploit is an exploitation framework designed to deliver payloads and gain control over systems, not to intercept and relay network traffic between two parties.
- ✗
Aircrack-ng and Wireshark
Why it's wrong here
Aircrack-ng is a suite of tools specifically designed for auditing wireless networks, primarily focused on cracking WEP/WPA/WPA2 keys to gain unauthorized access to Wi-Fi. While Wireshark can capture network traffic, Aircrack-ng does not provide the necessary mechanisms, such as ARP poisoning, to position an attacker in the middle of a wired or even an already-accessed wireless network communication path. Its core function is network access, not traffic interception for MITM.
- ✗
Ettercap and Nmap
Why it's wrong here
Ettercap is an excellent tool for performing Man-in-the-Middle attacks, particularly through ARP poisoning on a local area network. However, Nmap's role is network mapping and host discovery, identifying active devices and open ports. While reconnaissance is a preliminary step in many attacks, Nmap does not actively participate in the traffic interception and forwarding required for a MITM attack, making this combination incomplete for the direct execution of the attack.
- ✓
Ettercap and Wireshark
Why this is correct
Ettercap is a highly effective tool for executing Man-in-the-Middle attacks by performing ARP poisoning, which redirects network traffic through the attacker's machine. Wireshark then perfectly complements Ettercap by passively capturing and analyzing all the intercepted traffic that is now flowing through the attacker. This combination allows for both the successful interception of communications and the detailed examination of the data, making it ideal for a comprehensive MITM attack.
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.