CISSP Communication and Network Security Practice Question
A security analyst detects an attack where the attacker sends forged ARP messages to associate the attacker's MAC address with the IP address of the default gateway. Which OSI layer is primarily targeted by this attack?
⚠ Common exam trap
The trap here is that candidates see 'IP address' in the question and immediately think Layer 3 (Network), forgetting that ARP is a Layer 2 protocol that resolves Layer 3 addresses to Layer 2 addresses.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Layer 2 – Data Link
ARP operates at Layer 2 (Data Link) because it maps IP addresses (Layer 3) to MAC addresses (Layer 2) within a single broadcast domain. By forging ARP replies, the attacker poisons the ARP cache of hosts, causing frames destined for the default gateway to be sent to the attacker's MAC address. This directly targets the address resolution process that bridges Layer 2 and Layer 3, but the attack itself is executed at the Data Link layer.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Layer 4 – Transport
Why it's wrong here
The Transport layer, Layer 4, is responsible for end-to-end communication between applications, utilizing protocols like TCP and UDP for reliable or unreliable data transfer via port numbers. ARP, however, operates below this, resolving network-layer addresses to data-link layer addresses, a function unrelated to application-level session management or port multiplexing.
- ✗
Layer 3 – Network
Why it's wrong here
The Network layer, Layer 3, handles logical addressing (IP addresses) and routing of packets across different networks. While ARP works with IP addresses, its primary function is to map an IP address to a MAC address *within the same local network segment*, not to route packets between distinct networks, which is the core role of Layer 3 protocols like IP.
- ✗
Layer 1 – Physical
Why it's wrong here
Layer 1, the Physical layer, deals with the raw transmission of bits over physical media, encompassing electrical signals, optical pulses, and radio waves. ARP is a protocol that involves logical address resolution and message exchange, requiring a structured format and interpretation that is far more complex than the simple physical transmission of raw data, placing it at a higher layer.
- ✓
Layer 2 – Data Link
Why this is correct
The Data Link layer, Layer 2, is responsible for node-to-node data transfer within the same local network segment, using Media Access Control (MAC) addresses for frame delivery. ARP (Address Resolution Protocol) directly facilitates this by resolving an IP address (Layer 3) to its corresponding MAC address (Layer 2), enabling devices to communicate directly on the local network.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
MAC
MAC (Media Access Control) is a unique hardware identifier assigned to network interfaces for communication on a local network segment.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.