212-89 Practice Question: During a network incident, your IDS alerts on a series of TCP packets with the SYN flag…
During a network incident, your IDS alerts on a series of TCP packets with the SYN flag set and a source IP of 10.20.5.14, but packet captures on the internal switch show that the actual Ethernet source MAC address belongs to a workstation in the finance VLAN, while the IP 10.20.5.14 is assigned to a server in the DMZ. The workstation's ARP cache lists the DMZ server's IP as being at the workstation's own MAC address. Which network-based attack technique is the workstation most likely performing?
⚠ Common exam trap
A common mix-up: candidates confuse ARP cache poisoning with MAC flooding, because both manipulate Layer 2 addressing; the distinguishing evidence is that ARP poisoning creates specific IP-to-MAC mismatches, whereas MAC flooding overwhelms the switch CAM table.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ARP cache poisoning
The workstation is poisoning ARP caches to redirect traffic intended for the DMZ server to itself. The telltale sign is that the Ethernet source MAC belongs to the finance workstation while the IP source is the DMZ server's address, and the workstation's ARP cache incorrectly maps that IP to its own MAC. This man-in-the-middle positioning allows the attacker to intercept or alter traffic before forwarding it.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
MAC flooding
Why it's wrong here
MAC flooding involves overwhelming a switch's CAM table with numerous fake source MAC addresses so the switch fails open and broadcasts all frames. Here, the switch still forwards traffic normally and only one workstation's MAC is spoofing one IP; there is no evidence of CAM table exhaustion or broadcast storm, so this technique does not match the observed behavior.
- ✓
ARP cache poisoning
Why this is correct
The workstation is sending forged ARP replies to associate the DMZ server's IP with its own MAC address, causing traffic destined for the server to be redirected to the attacker. The mismatch between the Ethernet source MAC and the IP source in captured packets confirms this Layer 2 redirection, which is the defining behavior of ARP cache poisoning in a switched network.
- ✗
VLAN hopping
Why it's wrong here
VLAN hopping lets an attacker send traffic into a different VLAN by double-tagging 802.1Q frames or negotiating a trunk. The scenario shows the workstation in the finance VLAN spoofing an IP that belongs to the DMZ, but the packet capture still shows the workstation's own MAC, meaning no VLAN tag manipulation or trunk access is occurring.
- ✗
DHCP starvation
Why it's wrong here
DHCP starvation exhausts a DHCP server's address pool by requesting all available leases with spoofed MAC addresses, often as a precursor to a rogue DHCP server. The observed activity involves ARP cache manipulation and IP-to-MAC mismatches, not DHCP lease exhaustion or rogue DHCP offers, so this technique is not indicated.
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
About these practice questions
Courseiva writes every 212-89 question from scratch — 321 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
You might also like
Similar 212-89 questions
- During network forensics, you need to reconstruct an HTTP file transfer from a PCAP. Which Wireshark feature allows you…
- A network incident responder is analyzing a suspected ARP poisoning attack on a local subnet. Which two indicators would…
- When segmenting a network to contain an incident, what is the best practice for a 'Jump Server' in a DMZ to limit the at…
- An incident responder notices that a workstation is communicating with an external IP address on port 4444, and the traf…
- You are using NetFlow to identify lateral movement. You see a high volume of connections from a web server to an interna…
Written and reviewed by Johnson Ajibi, MSc IT Security
Security Systems Architect · founder of Courseiva
Last reviewed September 2026 · checked against the official EC-Council exam blueprint
This 212-89 practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 212-89 exam.