CEH Practice Question: Malware, Social Engineering and Network Attacks
During a penetration test, a tester discovers that the target switch's MAC address table is full, causing it to flood traffic out all ports. The tester then captures network traffic using Wireshark on the same segment. Which attack was the tester performing?
⚠ Common exam trap
The EC-CEH exam often tests the distinction between MAC flooding and ARP poisoning, where candidates mistakenly choose ARP poisoning because both involve traffic capture, but the key differentiator is that MAC flooding exploits a full CAM table, while ARP poisoning manipulates ARP caches without filling the switch's MAC table.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
MAC flooding
MAC flooding. When a switch's MAC address table is full, it can no longer learn new MAC addresses and enters a fail-open state, flooding all incoming frames out every port except the ingress port. This allows the tester to capture traffic destined for other hosts on the same VLAN by placing their NIC in promiscuous mode and using Wireshark, effectively performing a MAC flooding attack to turn the switch into a hub-like device.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
DNS spoofing
Why it's wrong here
DNS spoofing corrupts DNS records, not the MAC table.
- ✓
MAC flooding
Why this is correct
MAC flooding fills the switch's MAC address table, causing it to broadcast frames.
- ✗
Session hijacking
Why it's wrong here
Session hijacking steals session tokens, not related to MAC table overflow.
- ✗
ARP poisoning
Why it's wrong here
ARP poisoning corrupts the ARP cache, not the MAC table.
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.