ISC2 CC Network Security Practice Question
Which protocol is used to resolve IP addresses to MAC addresses on a local network?
⚠ Common exam trap
The trap is conflating DNS (name-to-IP) with ARP (IP-to-MAC); candidates who skim may pick DNS because both are 'resolution' protocols, but the question specifies IP-to-MAC on a local network.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ARP
ARP (Address Resolution Protocol) resolves a known IPv4 address to its corresponding MAC address on a local network segment by broadcasting an ARP request and receiving a unicast ARP reply. It is the standard Layer 2/Layer 3 glue protocol for Ethernet and IPv4 communication.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
ARP
Why this is correct
ARP broadcasts a request asking which device holds a given IPv4 address, and the owner replies with its MAC address, which the sender caches. This address-resolution function on the local segment is exactly what the stem asks for.
- ✗
DHCP
Why it's wrong here
DHCP assigns IP addresses, default gateways and DNS settings to hosts; it does not map a known IP address to a MAC address, which ARP performs by broadcasting on the local segment. DHCP is tempting because both protocols are configuration-related, and would be correct when a host needs an address lease rather than address resolution.
- ✗
DNS
Why it's wrong here
DNS maps hostnames to IP addresses, not IP addresses to MAC addresses, so it cannot resolve the local-link hardware address this scenario requires. It is tempting because DNS is the internet's primary name-resolution service, and it would be the correct choice when translating a domain name such as server.example.com into a routable IP address.
- ✗
ICMP
Why it's wrong here
ICMP carries diagnostic and error messages such as echo requests; it performs no address resolution and never returns a MAC address. It is tempting because ICMP is used alongside IP for troubleshooting connectivity, and it would be the correct choice when testing whether a host is reachable via ping.
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Network Security Foundations
Key term
Standard
A standard is an agreed-upon set of rules, guidelines, or specifications that ensure consistency, compatibility, and quality across IT products, services, and processes.
Key term
MAC
MAC (Media Access Control) is a unique hardware identifier assigned to network interfaces for communication on a local network segment.
About these practice questions
Courseiva writes every CC question from scratch — 989 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.