CISSP Communication and Network Security Practice Question
A security analyst observes a network attack where an attacker sends forged ARP messages to associate the attacker's MAC address with the IP address of the default gateway. This attack occurs at which layer of the OSI model?
⚠ Common exam trap
The trap here is that candidates see 'IP address' in the question and incorrectly associate it with Layer 3 (Network), forgetting that ARP is a Layer 2 protocol that resolves Layer 3 addresses to Layer 2 addresses.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Layer 2 – Data Link
ARP operates at Layer 2 (Data Link) because it maps IP addresses (Layer 3) to MAC addresses (Layer 2) and is encapsulated directly within an Ethernet frame, not an IP packet. The attack described—ARP spoofing—forges ARP replies to poison the target's ARP cache, which is a Layer 2 function. Therefore, the attack occurs at Layer 2 of the OSI model.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Layer 3 – Network
Why it's wrong here
The Network layer (Layer 3) is primarily responsible for logical addressing (IP addresses) and routing packets across different networks, enabling communication between distinct subnets. While ARP (Address Resolution Protocol) resolves IP addresses to MAC addresses, it operates at the layer below Layer 3 to facilitate communication *within* a local network segment, not for inter-network routing decisions. ARP spoofing manipulates this L3-to-L2 mapping, but the attack itself targets the Data Link layer protocol responsible for this resolution.
- ✗
Layer 1 – Physical
Why it's wrong here
The Physical layer (Layer 1) focuses on the raw, unstructured transmission of bits over physical media, defining electrical, mechanical, procedural, and functional specifications for activating, maintaining, and deactivating physical links. Attacks at this layer typically involve physical manipulation of cables, jamming radio signals, or disrupting power supplies. ARP spoofing, however, is a logical attack that manipulates protocol messages and address mappings, not the fundamental physical transmission medium or its characteristics.
- ✗
Layer 4 – Transport
Why it's wrong here
The Transport layer (Layer 4) is responsible for end-to-end communication between applications, managing connection establishment, data segmentation, flow control, and error recovery using protocols like TCP and UDP. Its primary function is to ensure reliable and ordered delivery of data between processes on source and destination hosts. ARP spoofing does not directly interfere with these end-to-end application-level connections or data streams; instead, it targets the underlying mechanism used to deliver packets to the correct host within a local segment.
- ✓
Layer 2 – Data Link
Why this is correct
The Data Link layer (Layer 2) is responsible for node-to-node data transfer and error correction from the physical layer, handling frame synchronization, flow control, and error checking. ARP (Address Resolution Protocol) operates at this layer, resolving Layer 3 IP addresses to Layer 2 MAC addresses within a local network segment to enable direct communication. ARP spoofing exploits this protocol by sending forged ARP messages, associating the attacker's MAC address with the IP address of another legitimate host, thereby redirecting traffic at the local network level.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
MAC
MAC (Media Access Control) is a unique hardware identifier assigned to network interfaces for communication on a local network segment.
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.