CISSP Communication and Network Security Practice Question
A security analyst notices that an attacker is sending forged ARP messages onto a local area network, linking the attacker's MAC address with the IP address of the default gateway. This allows the attacker to intercept traffic destined for the gateway. Which OSI layer is directly targeted by this attack?
⚠ Common exam trap
Many candidates confuse ARP's role in resolving IP addresses (Layer 3) with the layer at which the attack actually occurs, mistakenly choosing Layer 3 instead of recognizing that ARP operates at Layer 2 and exploits the Data Link layer's addressing scheme.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Layer 2 – Data Link
ARP spoofing (or ARP poisoning) operates at Layer 2 (Data Link) because ARP messages are encapsulated directly within Ethernet frames and rely on MAC addresses, not IP routing. By forging ARP replies, the attacker corrupts the IP-to-MAC mapping in the victim's ARP cache, causing frames destined for the default gateway to be sent to the attacker's MAC address instead. This attack exploits the lack of authentication in the ARP protocol (RFC 826) and directly targets the Data Link layer's addressing and frame delivery mechanism.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Layer 4 – Transport
Why it's wrong here
The Transport layer, Layer 4 of the OSI model, is primarily concerned with end-to-end communication between applications, managing services like connection establishment, data segmentation, and flow control through protocols such as TCP and UDP. ARP, however, operates at a lower level, resolving hardware addresses for local network delivery, and does not handle application-level data transfer or port-based communication.
- ✗
Layer 3 – Network
Why it's wrong here
Layer 3, the Network layer, focuses on logical addressing (IP addresses) and routing data packets across different networks or subnets. While IP relies on ARP to resolve the next-hop MAC address within a local segment, ARP itself does not perform routing or manage global logical addressing. Its function is strictly confined to mapping IP addresses to MAC addresses on the local broadcast domain, making it a supporting protocol for Layer 3 rather than a Layer 3 protocol itself.
- ✗
Layer 1 – Physical
Why it's wrong here
The Physical layer, Layer 1, deals with the raw transmission of bits over a physical medium, defining electrical, mechanical, procedural, and functional specifications for activating, maintaining, and deactivating physical links. It is concerned with voltage levels, cable types, and data rates, not with the logical structure or content of messages like ARP requests and replies. ARP messages contain structured data and addresses that require interpretation at a higher level of abstraction than raw bit streams.
- ✓
Layer 2 – Data Link
Why this is correct
The Data Link layer, Layer 2, is responsible for node-to-node data transfer, handling error correction from the physical layer and defining the format of data on the network segment. ARP (Address Resolution Protocol) is a foundational Layer 2 protocol, specifically designed to resolve logical IP addresses to physical MAC addresses within a local area network. ARP spoofing directly exploits the stateless and trusting nature of this layer's address resolution mechanism, allowing attackers to inject forged MAC-to-IP mappings into device ARP caches.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
MAC
MAC (Media Access Control) is a unique hardware identifier assigned to network interfaces for communication on a local network segment.
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.