200-201 Question 298
Select 3A cybersecurity analyst observes unusual network activity where multiple devices on the network are unable to communicate with the default gateway. Upon investigation, the analyst discovers that the ARP cache on several devices has been modified. Which of the following actions could have caused this issue?
- A
An attacker performed an ARP spoofing attack to intercept network traffic.
- B
A network switch malfunctioned, causing ARP tables to be improperly updated.
- C
A legitimate ARP request was broadcast to the network.
- D
An attacker flooded the network with ARP replies to exhaust device resources.
- E
The default gateway intentionally cleared ARP entries due to a scheduled reboot.
Show answer and explanation
Correct answers: A, B, D
Explanation
The issue described in the scenario indicates malicious or unintended ARP cache modifications. ARP spoofing and ARP flooding are common attack techniques that can disrupt network communication by altering ARP entries. Additionally, hardware malfunctions, such as a failing network switch, can also lead to ARP table corruption. Understanding ARP-related vulnerabilities and their impacts is critical for identifying and mitigating such issues in cybersecurity operations.
- A. Correct.
This is correct. ARP spoofing is a common attack where an attacker sends forged ARP messages to associate their MAC address with the IP address of another device, such as the default gateway.
- B. Correct.
This is correct. A malfunctioning network switch could cause ARP tables to become corrupted or improperly updated, disrupting communication.
- C. Incorrect.
This is incorrect. Legitimate ARP requests are normal network behavior and would not modify ARP caches in a malicious or unintended way.
- D. Correct.
This is correct. ARP flooding, also known as ARP cache poisoning, can overwhelm network devices and corrupt ARP caches, leading to communication issues.
- E. Incorrect.
This is incorrect. While a reboot of the default gateway may clear its own ARP cache, it would not cause widespread modifications to ARP caches on other devices.