SSCP Network and Communications Security Practice Question
An attacker is performing a man-in-the-middle attack at Layer 2 by sending forged ARP messages to associate their MAC address with the IP address of a legitimate host on the same subnet. This attack is known as:
⚠ Common exam trap
The trap is confusing ARP spoofing with other Layer 2 attacks like MAC flooding or DHCP spoofing; candidates must distinguish between attacks that manipulate ARP caches versus those that flood switch tables or provide rogue DHCP services.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ARP spoofing
ARP spoofing (also called ARP poisoning) involves an attacker sending forged ARP replies to associate their MAC address with the IP address of a legitimate host, causing traffic intended for that host to be sent to the attacker. This enables man-in-the-middle attacks at Layer 2. The scenario described exactly matches ARP spoofing.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
ARP spoofing
Why this is correct
ARP spoofing sends forged ARP replies that bind the attacker's MAC address to a legitimate host's IP, redirecting Layer 2 traffic through the attacker. This precisely matches the stem's man-in-the-middle mechanism, poisoning neighbours' ARP caches on the same subnet.
- ✗
DNS poisoning
Why it's wrong here
DNS poisoning corrupts name-resolution records so queries return attacker-controlled addresses; it operates at the application layer, not by forging ARP replies that bind a MAC to a legitimate host's IP. It is tempting because both redirect traffic, but DNS poisoning would be correct if the attacker altered resolver cache entries rather than ARP tables.
- ✗
DHCP spoofing
Why it's wrong here
DHCP spoofing involves a rogue server issuing falsified IP configuration, not forging ARP replies to bind a MAC to a victim's IP. It is tempting because both are Layer 2 attacks that redirect traffic on a subnet, but DHCP spoofing would be correct only when the attacker supplies a malicious default gateway or DNS server via DHCP.
- ✗
MAC flooding
Why it's wrong here
MAC flooding overflows a switch's CAM table so traffic is flooded to all ports; it does not forge ARP bindings between a victim's IP and the attacker's MAC. It is tempting because both are Layer 2 attacks, and would be correct if the stem described CAM table exhaustion.
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
About these practice questions
Courseiva writes every SSCP question from scratch — 971 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.