Chapter 48 · Quiz

On-Path Attacks Quiz

6 multiple-choice questions and a matching section. Submit to reveal answers and explanations.

Question 1 of 6

What is the fundamental security flaw in ARP that makes ARP poisoning possible?

A. ARP only supports IPv4 addresses, not IPv6, leaving a coverage gap that attackers exploit B. ARP has no authentication mechanism — any device can send an ARP reply claiming any IP address, and receiving devices accept the reply without verification C. ARP requests are broadcast to the entire internet rather than just the local subnet, exposing internal MAC addresses globally D. ARP cache entries never expire, so a poisoned entry persists indefinitely without any maintenance by the attacker

Question 2 of 6

During an ARP poisoning attack targeting traffic between a laptop (192.168.1.9, MAC …38:d5) and a router (192.168.1.1, MAC …BB:FE), what does the attacker send to the laptop?

A. An ARP request asking the laptop to confirm the router's current MAC address B. A spoofed DHCP offer assigning the attacker's IP address to the laptop's network interface C. An unsolicited ARP reply claiming "I am 192.168.1.1, my MAC address is EE:FF" — no ARP request was made; the attacker initiates this reply to overwrite the laptop's cached gateway MAC D. A TCP RST packet terminating all of the laptop's active connections to the router, forcing it to re-establish routes

Question 3 of 6

What is the result of a successful ARP poisoning attack where the attacker has poisoned both the laptop's and the router's ARP caches?

A. All traffic between the laptop and the router flows through the attacker's device; both endpoints continue communicating normally with no awareness of the interception B. The laptop and router can no longer communicate — all connections are severed until the ARP caches expire C. All traffic is duplicated: one copy goes to the attacker and one copy proceeds unmodified to the legitimate destination simultaneously D. The attack only intercepts traffic from the laptop to the router; return traffic travels unaffected directly from the router to the laptop

Question 4 of 6

Which of the following correctly describes a key scope limitation of ARP poisoning attacks?

A. ARP poisoning can only target devices using IPv6; devices communicating via IPv4 are immune to ARP-based attacks B. The attacker must be on the same Layer 2 subnet as both victims — ARP frames cannot cross router boundaries, so ARP poisoning cannot be performed from a different network segment C. ARP poisoning can only intercept HTTP traffic; HTTPS traffic is automatically protected against ARP-based interception D. ARP poisoning requires the attacker to know the IP and MAC addresses of both target devices before the attack begins

Question 5 of 6

Which switch-level security control directly prevents ARP poisoning by dropping forged ARP replies before they reach target devices?

A. 802.1X port-based authentication, which prevents unauthorized devices from connecting to network ports B. Port security with MAC address limiting, which restricts the number of MAC addresses allowed per switch port C. Dynamic ARP Inspection (DAI), which validates ARP replies against a trusted IP-to-MAC binding table derived from DHCP snooping and drops any reply that conflicts with the table D. Spanning Tree Protocol (STP) root guard, which prevents unauthorized switches from becoming the root bridge

Question 6 of 6

A bank customer reports unauthorized account transfers. Investigation shows the transactions used valid session tokens from the customer's own IP address, and network packet capture of the customer's traffic shows only clean, legitimate HTTPS connections to the bank's domain. Which attack most likely explains this scenario?

A. ARP poisoning on the bank's server network, redirecting the customer's traffic through an attacker's device B. On-path browser attack — malware on the customer's device intercepts banking sessions inside the browser before and after TLS encryption, capturing session tokens and initiating unauthorized transfers while producing legitimate-looking HTTPS traffic C. DNS poisoning redirecting the customer to a fraudulent banking site with a cloned interface D. SSL stripping downgrading the customer's HTTPS connection to HTTP, exposing credentials in the network capture

Matching — On-Path Attack Concepts

Match each term on the left to its correct description on the right.

1. On-Path Attack

2. ARP Poisoning

3. On-Path Browser Attack

4. Dynamic ARP Inspection

A. Switch-level control that validates ARP packets against a trusted IP-to-MAC binding table; drops replies that conflict with the table, preventing cache corruption

B. Attack that corrupts ARP caches by sending forged, unsolicited ARP replies; requires attacker to be on the same subnet as both victims; mitigated by DAI and network segmentation

C. Attack where the attacker positions themselves between two communicating devices; both victims believe they are communicating directly and are unaware of the attacker's presence

D. Malware-based attack operating inside the victim's own browser; intercepts traffic before encryption and after decryption; bypasses HTTPS; targets banking sessions for credential and session token theft

1 → 2 → 3 → 4 →