CEH Social Engineering and Physical Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Distributed denial of service (DDoS) attack

  Why it's wrong here

  A Distributed Denial of Service (DDoS) attack involves overwhelming a target with traffic from numerous compromised systems, aiming to exhaust resources and deny legitimate access. The output of `ping` and `arp -a` primarily reveals network layer connectivity and local address resolution anomalies, respectively. While a DDoS could impact network performance, these commands alone would not directly indicate the distributed nature or sheer volume of traffic characteristic of a DDoS attack, which typically requires traffic analysis or network monitoring tools.

• ✗

  MAC flooding attack

  Why it's wrong here

  A MAC flooding attack targets a network switch's Content Addressable Memory (CAM) table, overwhelming it with a large number of fake MAC-address-to-port mappings. This forces the switch to operate in a 'fail-open' mode, behaving like a hub and broadcasting all traffic to all ports, enabling sniffing. However, this attack primarily impacts the switch's internal forwarding logic and would not directly manifest as duplicate MAC addresses for different IP addresses within a host's ARP cache, which is what `arp -a` displays.

• ✓

  ARP spoofing attack

  Why this is correct

  An ARP spoofing attack, also known as ARP poisoning, involves an attacker sending forged Address Resolution Protocol (ARP) replies to a target system, associating the attacker's MAC address with the IP address of another legitimate device on the local network. The exhibit's indication of duplicate MAC addresses for different IP addresses in the ARP cache is a definitive symptom of this attack. This allows the attacker to intercept, modify, or drop traffic intended for the legitimate device, effectively performing a man-in-the-middle attack.

• ✗

  Ping flood attack

  Why it's wrong here

  A ping flood attack is a basic Denial of Service (DoS) technique where an attacker overwhelms a target with a high volume of ICMP echo requests (pings), consuming bandwidth and system resources. While the exhibit mentions `ping`, the critical evidence for identifying the attack type comes from the `arp -a` output, which shows anomalies in the ARP table. ARP anomalies, such as duplicate MAC addresses for different IPs, are not direct symptoms of a ping flood; they indicate issues with data link layer address resolution, not excessive ICMP traffic.

Go deeper

Related to this question