CEH Practice Question: Malware, Social Engineering and Network Attacks
During a penetration test, a tester uses a tool to perform ARP spoofing to intercept traffic between two hosts on the same subnet. Which tool is most commonly associated with this technique?
⚠ Common exam trap
A common mix-up: candidates confuse passive sniffing tools like Wireshark with active interception tools, assuming that any packet capture tool can also perform ARP spoofing, but Wireshark lacks the injection capability required for this attack.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Ettercap
Ettercap is the correct answer because it is a dedicated suite for man-in-the-middle attacks on LAN, with built-in ARP spoofing (poisoning) capabilities. It actively sends forged ARP replies to associate the tester's MAC address with the IP address of the target hosts, allowing interception of traffic between them on the same subnet. Other tools like Wireshark, Metasploit, and Nmap are not primarily designed for ARP spoofing.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Wireshark
Why it's wrong here
Wireshark is a powerful network protocol analyzer used for capturing and interactively browsing network traffic. While it can be invaluable for observing the effects of an ARP spoofing attack or analyzing the spoofed packets, it lacks the active capabilities to initiate or perform the Address Resolution Protocol (ARP) poisoning itself. Its function is diagnostic and analytical, focused on passive monitoring rather than active network manipulation.
- ✓
Ettercap
Why this is correct
Ettercap is a comprehensive suite specifically designed for performing man-in-the-middle (MITM) attacks on local area networks, with a core specialization in ARP spoofing (also known as ARP poisoning). It actively manipulates the ARP tables of target hosts and the network gateway by sending forged ARP replies, redirecting traffic through the attacker's machine. This capability enables various MITM activities, including sniffing, content filtering, and session hijacking, making it the ideal tool for actively performing such an attack during a penetration test.
- ✗
Metasploit
Why it's wrong here
Metasploit Framework is a robust penetration testing platform primarily focused on developing, testing, and executing exploits against remote targets and managing post-exploitation activities. While it can integrate with or leverage network manipulation techniques for specific module requirements or to facilitate exploitation, performing raw ARP spoofing is not its core or primary function. Its strength lies in vulnerability exploitation and payload delivery, rather than foundational network layer attacks like ARP poisoning.
- ✗
Nmap
Why it's wrong here
Nmap (Network Mapper) is an open-source utility for network discovery and security auditing, primarily used for port scanning, host discovery, and operating system detection. It excels at mapping network topologies and identifying live hosts and services by sending various types of packets and analyzing their responses. However, Nmap is fundamentally a passive and active scanning tool; it does not possess the functionality to actively manipulate network protocols like ARP to perform spoofing attacks.
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.