CEH Practice Question: Malware, Social Engineering and Network Attacks
Which tool is commonly used to perform DNS spoofing on a local network by intercepting DNS requests and replying with forged responses?
⚠ Common exam trap
EC-Council often tests the distinction between passive monitoring tools (Wireshark, tcpdump) and active attack tools (Ettercap), leading candidates to confuse packet capture capabilities with the ability to inject forged traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Ettercap
Ettercap is a comprehensive suite for man-in-the-middle attacks on a local network. It can perform DNS spoofing by intercepting DNS requests (typically over UDP port 53) and replying with forged responses before the legitimate DNS server can respond, redirecting victims to malicious IP addresses.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Ettercap
Why this is correct
Ettercap performs ARP poisoning to place itself between hosts and the DNS server, then intercepts DNS queries and returns forged replies, satisfying the local-network DNS spoofing requirement. Its integrated sniffing and filtering plugins make this man-in-the-middle attack practical without additional tooling.
- ✗
Wireshark
Why it's wrong here
Wireshark captures and analyses packets passively; it lacks any mechanism to inject forged DNS replies, so it cannot spoof responses. It is tempting because it inspects DNS traffic in detail, which is the correct choice for diagnosing or verifying spoofing after the fact rather than performing it.
- ✗
Nmap
Why it's wrong here
Nmap performs port scanning, service and host discovery, and its scripting engine can query DNS, but it does not intercept live queries and answer them with forged records. It is tempting because NSE scripts can enumerate DNS servers, which suits reconnaissance rather than on-path spoofing.
- ✗
tcpdump
Why it's wrong here
tcpdump captures and displays packet headers passively; it cannot intercept a DNS query and transmit a forged reply, so no spoofing occurs. It is tempting because it filters DNS traffic on the wire, which is the correct choice for capturing evidence of spoofing rather than conducting it.
About these practice questions
Courseiva writes every CEH question from scratch — 913 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.