Which of the following is a type of man-in-the-middle attack in which the communicating devices on a company LAN have their layer 2 frames redirected to the attacker who also resides on the same LAN.

Optimize your success on the FSNA Readiness Exam. Engage with flashcards and multiple choice questions, each designed with hints and explanations. Prepare thoroughly for your test and excel!

Multiple Choice

Which of the following is a type of man-in-the-middle attack in which the communicating devices on a company LAN have their layer 2 frames redirected to the attacker who also resides on the same LAN.

The key idea here is ARP poisoning, also known as ARP spoofing. ARP is how devices on a local network map IP addresses to MAC addresses, but this mapping isn’t secured. An attacker who shares the LAN can send spoofed ARP replies that convince other devices that a trusted host’s IP is associated with the attacker's MAC address. Once those ARP caches are poisoned, traffic intended for that host is sent to the attacker at layer 2. The attacker can then forward the traffic to the real destination to keep the connection alive while eavesdropping or altering data, effectively placing the attacker in the middle of the conversation. DNS spoofing operates at name resolution and redirects users to a different IP based on domain names, not by altering who receives LAN frames. IP spoofing involves forging the source IP in packets, which can enable various attacks but doesn’t inherently redirect layer 2 frames on a LAN to the attacker. MAC flooding aims to overwhelm a switch’s CAM table to cause flooding, leading to DoS rather than MITM interception.

The key idea here is ARP poisoning, also known as ARP spoofing. ARP is how devices on a local network map IP addresses to MAC addresses, but this mapping isn’t secured. An attacker who shares the LAN can send spoofed ARP replies that convince other devices that a trusted host’s IP is associated with the attacker's MAC address. Once those ARP caches are poisoned, traffic intended for that host is sent to the attacker at layer 2. The attacker can then forward the traffic to the real destination to keep the connection alive while eavesdropping or altering data, effectively placing the attacker in the middle of the conversation.

DNS spoofing operates at name resolution and redirects users to a different IP based on domain names, not by altering who receives LAN frames. IP spoofing involves forging the source IP in packets, which can enable various attacks but doesn’t inherently redirect layer 2 frames on a LAN to the attacker. MAC flooding aims to overwhelm a switch’s CAM table to cause flooding, leading to DoS rather than MITM interception.

More practice questions