SSCP Network and Communications Security Practice Question
During a penetration test, a security analyst captures a packet containing a gratuitous ARP reply that associates the attacker's MAC address with the default gateway's IP address. This is a classic indicator of which attack?
⚠ Common exam trap
SSCP often tests the distinction between ARP spoofing and DHCP spoofing, as both can redirect traffic but operate at different layers and use different protocols; candidates may confuse the two if they overlook the specific mention of gratuitous ARP.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ARP spoofing
A gratuitous ARP reply is an ARP packet sent without a prior request, typically used to announce a change in MAC-to-IP mapping. In this case, the attacker sends a gratuitous ARP reply claiming that the default gateway's IP address now maps to the attacker's MAC address. This poisons the ARP cache of other hosts on the network, causing them to send traffic destined for the gateway to the attacker instead. This is the defining characteristic of ARP spoofing (also called ARP poisoning).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
ARP spoofing
Why this is correct
A gratuitous ARP reply that binds the gateway's IP to the attacker's MAC is the defining signature of ARP spoofing, poisoning victims' ARP caches so traffic destined for the gateway is redirected to the attacker for interception or modification.
- ✗
DHCP spoofing
Why it's wrong here
DHCP spoofing involves a rogue server issuing falsified IP leases, not gratuitous ARP replies binding a gateway IP to an attacker MAC. It is the right answer when clients receive incorrect gateway or DNS settings via DHCP, not for ARP cache poisoning.
- ✗
MAC cloning
Why it's wrong here
MAC cloning duplicates a legitimate device's MAC address to impersonate it, but does not itself send gratuitous ARP replies associating the gateway IP with the attacker's MAC. It applies when bypassing MAC filtering or port security, not for gateway ARP cache poisoning.
- ✗
DNS poisoning
Why it's wrong here
DNS poisoning corrupts name-resolution records, redirecting hostnames to malicious IPs; it does not manipulate ARP mappings between IP and MAC addresses. It fits scenarios where DNS responses are forged, not where a gratuitous ARP reply rewrites the gateway's MAC binding.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
One of 971 original SSCP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.