CEH Practice Question: Malware, Social Engineering and Network Attacks
Which tool would a penetration tester MOST likely use to perform ARP poisoning and conduct a man-in-the-middle attack on a local network?
⚠ Common exam trap
EC-CEH often tests the distinction between passive monitoring tools (Wireshark, tcpdump) and active attack tools (Ettercap), leading candidates to mistakenly choose a packet sniffer when the question explicitly requires performing an active man-in-the-middle attack.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Ettercap
Ettercap is a dedicated suite for man-in-the-middle attacks on LANs, with built-in support for ARP poisoning. It actively sends forged ARP replies to associate the attacker's MAC address with the IP of a legitimate host, allowing interception of traffic between two hosts. This makes it the most direct and purpose-built tool for the task described.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Wireshark
Why it's wrong here
Wireshark is a powerful graphical user interface (GUI) packet analyzer used for network troubleshooting, analysis, software and communications protocol development, and education. While it can capture and display ARP traffic, it is a passive monitoring tool that observes network communications without actively manipulating or injecting packets to perform an ARP poisoning attack. Its primary function is forensic analysis of captured data, not active network exploitation.
- ✗
Nmap
Why it's wrong here
Nmap, or Network Mapper, is a versatile open-source utility for network discovery and security auditing, primarily used for host discovery, port scanning, and operating system detection. It excels at mapping network topologies and identifying services running on target systems by sending specially crafted packets and analyzing responses. However, Nmap does not possess the built-in functionality to actively spoof ARP messages or conduct man-in-the-middle attacks through ARP poisoning.
- ✗
tcpdump
Why it's wrong here
tcpdump is a command-line packet analyzer that allows users to intercept and display TCP/IP and other packets being transmitted or received over a network. It is an essential tool for network diagnostics and security analysis, providing raw packet data for inspection. Unlike active exploitation tools, tcpdump is designed solely for passive observation and logging of network traffic, lacking any capabilities to craft and inject malicious ARP responses necessary for poisoning.
- ✓
Ettercap
Why this is correct
Ettercap is a comprehensive suite for man-in-the-middle (MITM) attacks on a LAN, specifically designed to intercept traffic, perform live content filtering, and establish various forms of active and passive eavesdropping. Its core functionality includes robust ARP poisoning capabilities, allowing it to redirect traffic between two hosts through the attacker's machine by sending forged ARP replies. This enables the penetration tester to intercept, modify, and inject data into network communications, making it the ideal tool for demonstrating MITM vulnerabilities.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.