ISC2 CC Network Security Practice Question
An attacker captures network traffic and forges the source IP address to impersonate a trusted host. Which type of network threat is this?
⚠ Common exam trap
The trap is confusing spoofing with MITM — candidates pick MITM because both involve impersonation, but the scenario describes only forging a source IP, not intercepting an existing session between two parties.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Spoofing
Spoofing is the act of forging a source IP address (or other identity field) to impersonate a trusted host. In this scenario, the attacker captures traffic and crafts packets with a falsified source IP to make them appear to originate from a trusted system. This is the definition of IP spoofing, a foundational network threat.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Sniffing
Why it's wrong here
Sniffing passively captures traffic without altering packets, so it cannot forge a source address to impersonate a trusted host. Sniffing would be the answer where an attacker only monitors unencrypted traffic to harvest credentials or data.
- ✓
Spoofing
Why this is correct
Forging the source IP address to impersonate a trusted host is IP address spoofing. The attacker manipulates the packet header's source field so the receiver believes traffic originates from a legitimate system, enabling masquerade and bypassing trust-based access controls.
- ✗
Man-in-the-middle
Why it's wrong here
Man-in-the-middle intercepts or relays traffic between two parties, typically requiring session positioning or certificate manipulation, not forged source addresses. Spoofing a trusted host's IP to bypass filtering is IP address spoofing, which is the threat described.
- ✗
Denial of Service
Why it's wrong here
Denial of Service floods a target to exhaust its resources; forging a trusted source address to impersonate a host is spoofing, often enabling reflection or session hijacking. DoS is tempting because spoofed packets frequently amplify attacks, but the defining mechanism here is source-address falsification.
Go deeper
Related to this question
About these practice questions
One of 989 original CC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.