Sniffing Quiz · LabYard

Q1. ARP spoofing can allow an attacker to:

Improve encryption Patch systems Intercept network traffic Create backups

Q2. Dynamic ARP Inspection protects a network by:

Encrypting ARP Rate limiting ICMP Disabling ARP entirely Validating ARP packets against DHCP snooping bindings

Q3. Passive sniffing is effective on a network built with:

Firewalls Hubs, where every frame reaches every port Switches Routers

Q4. A network tap differs from a SPAN port because a tap:

Only sees broadcast Copies traffic passively in hardware without loading the switch Requires a switch Modifies packets

Q5. Which is another type of DNS poisoning listed?

SNMP flooding FTP poisoning Intranet DNS spoofing SMTP spoofing only

Q6. An ARP request is normally:

Sent only to a DNS server Encrypted by SMTP Sent through a web proxy Broadcast on the TCP/IP network

Q7. ARP spoofing enables sniffing on a switched network by:

Disabling STP Convincing hosts that the attacker's MAC belongs to the gateway IP Cloning the MAC address Flooding the switch

Q8. A BPF capture filter such as host 10.0.0.5 is applied:

Only in Wireshark To the display only At capture time, so unmatched packets are never written After analysis

Q9. Which is a type of DNS poisoning?

TCP port scanning Password spraying LDAP enumeration DNS cache poisoning

Q10. Capturing traffic on a client engagement requires special care because:

It needs a licence Captures may contain personal data and credentials that must be protected It is technically difficult It slows the network

Q11. Follow TCP Stream in Wireshark is used to:

Replay the traffic Decrypt TLS Block the connection Reassemble a conversation into readable form

Q12. Detecting a host in promiscuous mode is possible because it may:

Send more ARP requests Use more bandwidth Respond to packets addressed to a non-existent MAC Change its IP

Q13. MAC flooding can overload:

A web browser A DNS server An email client A switch

Q14. Passive sniffing is associated with:

A proxy A firewall A switch A hub

Q15. DNS poisoning involves:

Creating a backup DNS server Tricking a DNS server with false information Deleting all DNS records Encrypting DNS with SSH