Ethical Hacking Essentials Practice Test

What type of attack did Smith perform when he flooded the switch with a fake physical address?

1. DHCP starvation

2. ARP spoofing

3. MAC Flooding

4. DNS poisoning

The correct answer is: MAC Flooding

The action of flooding a switch with fake physical (MAC) addresses is characteristic of a MAC flooding attack. In this scenario, the attacker sends a large number of packets with varying source MAC addresses to the network switch. The switch, which maintains a MAC address table to direct traffic, becomes overwhelmed as it attempts to learn these new addresses. As the table fills up, it can no longer accurately track which MAC address corresponds to which port, leading to the switch entering a fail-open mode. In this mode, it behaves like a hub, broadcasting all incoming packets to every port, which allows the attacker to intercept traffic intended for other devices on the network. The other options refer to different types of attacks. DHCP starvation involves exhausting the DHCP server's available IP addresses, ARP spoofing is about sending fake ARP messages to associate the attacker's MAC address with the IP address of another host, and DNS poisoning tricks the DNS server into returning an incorrect IP address for a domain, redirecting traffic to a malicious site. These attacks utilize different protocols and mechanisms compared to the MAC flooding method.