CEH Practice Question: Malware, Social Engineering and Network Attacks
During a penetration test, a tester captures network traffic and notices a large number of ARP replies claiming that 192.168.1.1 is at MAC address 00:11:22:33:44:55, which is different from the legitimate gateway MAC. Which attack is likely in progress?
⚠ Common exam trap
The trap in this question is confusing ARP poisoning (which manipulates Layer 2 MAC-to-IP mappings via forged ARP replies) with MAC flooding (which overwhelms switch CAM tables with fake MAC addresses). The key clue is that the attacker is sending multiple ARP replies for a single target IP (the gateway) with a spoofed MAC, not a flood of different MACs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ARP poisoning
ARP poisoning (also known as ARP spoofing) is the correct answer because the attacker is sending forged ARP replies that associate the legitimate gateway IP (192.168.1.1) with an attacker-controlled MAC address (00:11:22:33:44:55). This causes victim hosts to update their ARP cache with the false mapping, redirecting traffic intended for the gateway to the attacker's machine, enabling man-in-the-middle (MITM) attacks.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Session hijacking
Why it's wrong here
Session hijacking steals session tokens; ARP poisoning can be used to facilitate it, but the described traffic is ARP-specific.
- ✓
ARP poisoning
Why this is correct
Forged ARP replies bind the attacker's MAC to the gateway IP, allowing interception of traffic.
- ✗
MAC flooding
Why it's wrong here
MAC flooding overwhelms switch MAC tables, not send forged ARP replies.
- ✗
DNS spoofing
Why it's wrong here
DNS spoofing corrupts DNS resolution, not ARP tables.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.