CEH Practice Question: Malware, Social Engineering and Network Attacks

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Execute a SYN flood against the target

  Why it's wrong here

  macof is a Layer 2 tool designed to generate a large number of random MAC addresses, overwhelming a switch's Content Addressable Memory (CAM) table. A SYN flood, conversely, is a Layer 4 denial-of-service attack that exploits the TCP three-way handshake by sending a flood of SYN requests without completing the final ACK, exhausting server resources. Therefore, macof is not used for executing a SYN flood, which requires tools like hping3 or Nmap's scripting engine.

• ✓

  Perform MAC flooding to cause switch to fail open

  Why this is correct

  The command macof -i eth0 specifically performs MAC flooding by continuously sending frames with randomly generated source MAC addresses to exhaust the switch's Content Addressable Memory (CAM) table. When the CAM table overflows, the switch typically enters a "fail-open" mode, behaving like a hub by broadcasting all incoming traffic out of all ports. This allows an attacker connected to any port on the switch to capture and analyze all network traffic, effectively bypassing the switch's normal segmentation.

• ✗

  Perform ARP poisoning

  Why it's wrong here

  macof operates by flooding the network with numerous frames containing random source MAC addresses to overwhelm a switch's CAM table. ARP poisoning, on the other hand, involves sending spoofed ARP reply messages to associate an attacker's MAC address with the IP address of another host (like the default gateway or a target server). This redirection of traffic is fundamentally different from macof's Layer 2 table exhaustion technique, which does not manipulate ARP caches.

• ✗

  Spoof DNS responses

  Why it's wrong here

  macof is a Layer 2 utility designed to flood a switch's CAM table with random MAC addresses, forcing it into a hub-like state. DNS spoofing, however, is a Layer 7 attack where an attacker intercepts or manipulates DNS queries and responses to redirect users to malicious websites or services. This attack typically involves tools such as dnsspoof or manipulating DNS server entries, which is entirely unrelated to macof's MAC address generation and switch table overflow mechanism.

Go deeper

Related to this question