Courseiva
Malware, Social Engineering and Network AttackseasyMultiple ChoiceObjective-mapped

CEH Practice Question: Malware, Social Engineering and Network Attacks

Which tool is commonly used for ARP spoofing attacks to perform man-in-the-middle (MITM) attacks on a local network?

⚠ Common exam trap

A common mix-up: candidates confuse passive sniffing tools like Wireshark with active interception tools, or assume Metasploit's broad capabilities include ARP spoofing as its primary function, when Ettercap is the specialized tool for this task.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

Ettercap

Ettercap is a dedicated suite for man-in-the-middle attacks on LAN, with built-in ARP spoofing capabilities. It actively sends forged ARP replies to poison the ARP cache of target hosts, allowing the attacker to intercept, modify, or drop traffic between them. This makes it the standard tool for ARP-based MITM attacks.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • Nmap

    Why it's wrong here

    Nmap is a port scanner, not designed for ARP spoofing.

  • Ettercap

    Why this is correct

    Ettercap supports ARP poisoning, DNS spoofing, and other MITM techniques.

  • Wireshark

    Why it's wrong here

    Wireshark is a packet analyzer, not an attack tool.

  • Metasploit

    Why it's wrong here

    Metasploit is an exploitation framework; it can be used in conjunction with other tools but is not the primary ARP spoofing tool.

About these practice questions

This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Same concept, more angles

3 more ways this is tested on CEH

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. Which TWO tools are commonly used for ARP poisoning attacks?

medium
  • A.Wireshark
  • B.Cain & Abel
  • C.tcpdump
  • D.Ettercap
  • E.Nmap

Why B: Cain & Abel and Ettercap are both dedicated ARP poisoning tools that manipulate the ARP cache of target devices to intercept traffic on a local network. Cain & Abel performs ARP poisoning to enable man-in-the-middle attacks, while Ettercap uses ARP spoofing to redirect packets between hosts. Both tools are explicitly listed in CEH exam objectives for network sniffing and MITM attacks.

Variation 2. A penetration tester needs to perform ARP poisoning to intercept traffic between two hosts on the same subnet. Which tool would be the most appropriate choice for this task?

medium
  • A.tcpdump
  • B.Ettercap
  • C.Nmap
  • D.Wireshark

Why B: Ettercap is the most appropriate tool for ARP poisoning because it is specifically designed for man-in-the-middle (MITM) attacks on a local area network (LAN). It automates ARP spoofing by sending forged ARP replies to both target hosts, poisoning their ARP caches so that traffic intended for the other host is redirected through the attacker's machine, enabling interception and modification of packets.

Variation 3. Which tool can be used to perform ARP poisoning to intercept traffic between a victim and the default gateway?

medium
  • A.Wireshark
  • B.Ettercap
  • C.tcpdump
  • D.Nmap

Why B: Ettercap is a dedicated man-in-the-middle (MITM) attack tool that natively supports ARP poisoning. It sends forged ARP replies to both the victim and the default gateway, mapping the attacker's MAC address to the IP addresses of the other party. This allows the attacker to intercept, inspect, and modify traffic between the victim and the gateway.

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.