ISC2 CC Network Security Practice Question
During a penetration test, an analyst uses a tool to intercept and modify traffic between a client and server by exploiting the Address Resolution Protocol (ARP). This attack is an example of which type of threat?
⚠ Common exam trap
The trap is that ARP poisoning technically involves spoofing, so candidates pick 'Spoofing' — but the exam wants the attack category that describes the full outcome (interception plus modification), which is MITM.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Man-in-the-middle (MITM)
ARP poisoning lets an attacker send forged ARP replies so that the victim's traffic is redirected through the attacker's machine. Because the attacker sits between the client and the server, silently relaying and potentially altering packets, this is a classic man-in-the-middle (MITM) attack. The interception and modification of traffic is the defining characteristic that distinguishes MITM from mere spoofing or sniffing.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Spoofing
Why it's wrong here
Spoofing forges a sender's identity, such as a falsified ARP reply, but the scenario's defining act is positioning between client and server to intercept and modify traffic. It is tempting because ARP poisoning does involve forged ARP messages, yet on-path manipulation is the threat being demonstrated.
- ✗
Denial of Service (DoS)
Why it's wrong here
A DoS attack exhausts or disrupts a service to deny legitimate access; ARP poisoning here redirects and edits traffic rather than degrading availability. It is tempting because ARP attacks can disrupt connectivity, but DoS is correct when the objective is outage, not covert interception and modification.
- ✗
Sniffing
Why it's wrong here
Sniffing passively captures traffic without altering it, whereas ARP cache poisoning lets the analyst sit inline and modify packets in transit. It is tempting because sniffing also targets client-server traffic, but it is the correct answer when only observation, not interception and modification, is required.
- ✓
Man-in-the-middle (MITM)
Why this is correct
ARP spoofing lets the attacker position themselves between client and server, silently relaying and altering frames while both endpoints believe they hold a direct connection. That interception and modification of live traffic is precisely the man-in-the-middle condition the scenario describes, satisfying the requirement that communications pass through the attacker.
Go deeper
Related to this question
Key term
Threat
A threat is any potential danger that could harm a computer system, network, or data, whether from a malicious hacker, a natural disaster, or an accidental mistake.
Key term
Penetration test
A penetration test is a simulated cyberattack against a computer system, network, or application to identify security weaknesses that an attacker could exploit.
About these practice questions
Courseiva writes every CC question from scratch — 989 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.