SSCP Network and Communications Security Practice Question
An attacker sends a gratuitous ARP reply associating the attacker's MAC address with the default gateway's IP address. Which attack is being performed, and what is the primary risk?
⚠ Common exam trap
The trap is that gratuitous ARP sounds like a DNS or DHCP concept to candidates unfamiliar with layer 2 attacks — the key discriminator is that the attack manipulates MAC-to-IP bindings in the ARP cache, which points to ARP spoofing, not DNS or DHCP attacks.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ARP spoofing; risk is man-in-the-middle traffic interception.
A gratuitous ARP reply that binds the attacker's MAC to the gateway's IP is the classic ARP spoofing (ARP poisoning) attack. The victim's ARP cache is poisoned so traffic destined for the gateway is sent to the attacker, enabling man-in-the-middle interception, modification, or denial of service.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
DNS poisoning; risk is traffic redirection to malicious sites.
Why it's wrong here
DNS poisoning corrupts name-resolution records so hostnames resolve to attacker-controlled addresses; it operates at the DNS layer, not on ARP-to-MAC bindings. The gratuitous ARP reply is ARP cache poisoning, redirecting gateway traffic. DNS poisoning would be correct when malicious DNS responses redirect clients to fake sites.
- ✗
DHCP starvation; risk is denial of service.
Why it's wrong here
DHCP starvation consumes the DHCP address pool with spoofed DISCOVER requests, causing denial of service for new clients. It does not rewrite the gateway's IP-to-MAC binding. The described gratuitous ARP reply is ARP cache poisoning, redirecting traffic through the attacker. DHCP starvation would be correct when the pool is exhausted.
- ✗
SYN flood; risk is resource exhaustion.
Why it's wrong here
A SYN flood exhausts TCP connection state through half-open handshakes; it does not forge ARP-to-MAC bindings. The described gratuitous ARP reply is ARP cache poisoning, whose primary risk is traffic redirection through the attacker. SYN flood would be correct when the risk cited is server resource exhaustion.
- ✓
ARP spoofing; risk is man-in-the-middle traffic interception.
Why this is correct
Gratuitous ARP replies let the attacker poison victims' ARP caches, binding the gateway's IP to the attacker's MAC. Traffic destined for the gateway is then redirected through the attacker, enabling man-in-the-middle interception and potential modification of communications.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
This SSCP question is part of Courseiva's 971-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SSCP
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An attacker sends a forged ARP reply associating the attacker's MAC address with the IP address of the default gateway. What type of attack is this?
medium- ✓ A.ARP spoofing
- B.MAC flooding
- C.DHCP starvation
- D.DNS poisoning
Why A: ARP spoofing (also called ARP cache poisoning) is the attack in which a malicious host sends forged ARP replies to bind its own MAC address to the IP address of a legitimate host — here, the default gateway. Because ARP has no authentication mechanism, victims update their ARP caches with the attacker's MAC, causing traffic destined for the gateway to flow through the attacker, enabling man-in-the-middle interception.
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.