SSCP Network and Communications Security Practice Question
An attacker sends a forged ARP reply associating the attacker's MAC address with the IP address of the default gateway. What type of attack is this?
⚠ Common exam trap
Many exam-takers confuse layer-2 attacks: candidates may pick MAC flooding because it also involves MAC addresses, but only ARP spoofing forges the IP-to-MAC binding of the gateway.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ARP spoofing
ARP spoofing (also called ARP cache poisoning) is the attack in which a malicious host sends forged ARP replies to bind its own MAC address to the IP address of a legitimate host — here, the default gateway. Because ARP has no authentication mechanism, victims update their ARP caches with the attacker's MAC, causing traffic destined for the gateway to flow through the attacker, enabling man-in-the-middle interception.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
ARP spoofing
Why this is correct
ARP spoofing fits because the attacker forges an ARP reply, binding their MAC address to the gateway's IP. This poisons the victim's ARP cache, redirecting traffic through the attacker for interception. The stem's defining constraint — a falsified ARP reply impersonating the default gateway — is precisely ARP spoofing, not DNS or IP spoofing.
- ✗
MAC flooding
Why it's wrong here
MAC flooding overwhelms a switch's content-addressable memory table with bogus source addresses, forcing it to flood frames. It is tempting because both attacks abuse layer-two addressing, but MAC flooding causes frame flooding rather than redirecting gateway traffic to the attacker.
- ✗
DHCP starvation
Why it's wrong here
DHCP starvation exhausts a server's address pool with forged DISCOVER requests, denying leases to legitimate clients. It is tempting because both attacks involve forged layer-two frames, but DHCP starvation targets address allocation, not gateway MAC-to-IP mappings.
- ✗
DNS poisoning
Why it's wrong here
DNS poisoning corrupts name-resolution records so hostnames resolve to attacker-controlled addresses. It is tempting because both redirect traffic, but DNS poisoning operates at the name-resolution layer, not by forging ARP replies that bind a gateway IP to an attacker's MAC address.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SSCP question from scratch — 971 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.