200-201 Question 297
Single answerA security analyst is investigating a network issue where multiple devices on the same subnet are experiencing intermittent connectivity problems. Upon analysis, the analyst notices a large number of unsolicited ARP replies being broadcast across the network. What is the MOST likely cause of this issue?
- A
An ARP spoofing attack
- B
A misconfigured DHCP server
- C
A broadcast storm due to a faulty switch
- D
A legitimate device updating its ARP table
Show answer and explanation
Correct answer: A
Explanation
The scenario describes a situation where multiple unsolicited ARP replies are seen on the network, which aligns with the characteristics of an ARP spoofing attack. ARP spoofing is a common attack where an attacker sends falsified ARP messages to associate their MAC address with another device’s IP, enabling them to intercept, modify, or disrupt traffic.
- A. Correct.
Correct: An ARP spoofing attack involves sending unsolicited ARP replies to trick devices into associating an attacker’s MAC address with a legitimate IP address, leading to connectivity issues or data interception.
- B. Incorrect.
Incorrect: A misconfigured DHCP server would typically cause issues with IP address assignment rather than ARP-related problems.
- C. Incorrect.
Incorrect: A broadcast storm results from excessive broadcast traffic on the network, but it is unrelated to unsolicited ARP replies.
- D. Incorrect.
Incorrect: While devices do update their ARP tables, they do not do so by sending unsolicited ARP replies across the network. This behavior is abnormal and typically indicates malicious activity.