200-201 Question 279
Single answerA security analyst is investigating suspicious network activity and captures an Ethernet frame using a packet analyzer. The frame has a destination MAC address of FF:FF:FF:FF:FF:FF. What is the purpose of this frame, and how should the analyst interpret it?
- A
It is a broadcast frame intended for all devices in the local network segment.
- B
It is a unicast frame intended for a specific device on the network.
- C
It is a multicast frame intended for a group of devices on the network.
- D
It is an invalid frame and should be discarded by all devices on the network.
Show answer and explanation
Correct answer: A
Explanation
In Ethernet networks, the destination MAC address FF:FF:FF:FF:FF:FF is a special broadcast address. Frames with this destination are received and processed by all devices on the local network segment. This is commonly used for scenarios like ARP requests and network discovery. Understanding the purpose of different types of Ethernet frames is crucial for analyzing and troubleshooting network traffic.
- A. Correct.
This is correct. The destination MAC address FF:FF:FF:FF:FF:FF indicates a broadcast frame that is sent to all devices in the local network segment.
- B. Incorrect.
This is incorrect. A unicast frame is sent to a specific device and would have a destination MAC address that matches that device's MAC.
- C. Incorrect.
This is incorrect. A multicast frame is sent to a group of devices and would have a destination MAC address that falls within the multicast range (e.g., starting with '01:00:5E').
- D. Incorrect.
This is incorrect. FF:FF:FF:FF:FF:FF is a valid broadcast MAC address and is processed by all devices on the local segment.