CISSP Communication and Network Security Practice Question
During a security assessment, a penetration tester successfully performs an ARP spoofing attack, redirecting traffic through their machine. This attack exploits which protocol vulnerability?
⚠ Common exam trap
CISSP candidates often confuse the stateless nature of ARP (no authentication) with the use of broadcast frames. While ARP uses broadcasts for requests, the vulnerability is that any host can send unsolicited replies (gratuitous ARP) without validation, not the broadcast mechanism itself.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Stateless nature of ARP with no authentication
ARP spoofing succeeds because ARP is a stateless protocol that does not authenticate or verify the legitimacy of ARP replies. Any host on a local network can send an unsolicited ARP reply (gratuitous ARP) to associate any IP address with any MAC address, allowing an attacker to redirect traffic without any validation mechanism.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Stateless nature of ARP with no authentication
Why this is correct
ARP's stateless design means it does not maintain session information or prior trust relationships between IP and MAC addresses. Consequently, it lacks any built-in authentication mechanism to verify the sender's legitimacy for ARP replies. This fundamental absence of authentication allows any host on the local network to send forged ARP replies, which are then accepted and cached by other devices without verification, leading directly to vulnerabilities like ARP spoofing.
- ✗
Lack of encryption in ARP packets
Why it's wrong here
While ARP packets are indeed transmitted without encryption, this lack primarily impacts confidentiality, not the ability to spoof. Encryption prevents eavesdropping on the mapping information, but it would not inherently prevent a malicious actor from generating and sending forged ARP replies. The core vulnerability enabling ARP spoofing is the absence of authentication, which allows forged packets to be trusted, rather than the lack of data secrecy.
- ✗
Weakness in the IP address resolution algorithm
Why it's wrong here
The IP address resolution algorithm itself, which involves broadcasting a request for a MAC address corresponding to a known IP and receiving a unicast reply, is functionally robust for its intended purpose. The weakness lies not in the algorithmic logic of how addresses are resolved, but in the complete absence of security controls around the acceptance and caching of these resolution replies. The process is efficient but inherently trusts all responses without validation, making it susceptible to manipulation.
- ✗
Use of broadcast frames for all requests
Why it's wrong here
The use of broadcast frames for ARP requests is a standard and efficient method for discovering unknown MAC addresses on a local network segment. This broadcast mechanism is a normal operational aspect of Ethernet and is not inherently a security vulnerability. The actual flaw that enables ARP spoofing is the subsequent unverified acceptance of *any* ARP reply, whether solicited or unsolicited, without authenticating the sender or validating the information provided.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Vulnerability
A vulnerability is a weakness in a system, network, or software that could be exploited by a threat to cause harm or unauthorized access.
About these practice questions
One of 747 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.