FirstTry

Exam objective

CEH

Sniffing

This objective sits in Network and Perimeter Hacking, which carries 24% of the CEH exam. The questions below are original, written from the official objective title above, and each explanation cites the EC-Council page it rests on.

Objective title verbatim from the official objectives. EC-Council exam page ↗

A worked example

Shown solved, with the whole explanation open: this is what every question here carries.

Network and Perimeter Hacking

An analyst captures traffic on a switched LAN and sees the gateway address answered by two different MAC addresses milliseconds apart. Which property lets the false entry stick?

ARP is stateless and requires no authentication of repliesCorrect · your answerCorrect.
ARP replies are checked against the switch MAC address tableSwitches learn MAC addresses from frame headers for forwarding decisions. That table is never consulted to validate the contents of an ARP payload.
ARP entries are refreshed only by the DHCP server leaseDHCP binds an address at lease time. It plays no part in how a host fills or refreshes its own resolution cache.
ARP requests are sent as unicast to the gatewayRequests go out as broadcasts to the whole segment, which is exactly what lets a listening station answer first.

Correct.

Checked against attack.mitre.org, September 2026

Concept

Address resolution on a local segment was designed for cooperative hosts. A machine keeps whatever mapping arrives for an address it needs, so any station on the segment can claim to own another station's address.

Why A

Both frames are well formed, and nothing in the protocol lets the host tell a forged reply from a genuine one, so the newest mapping is the one used.

Source

The ARP protocol is stateless and does not require authentication. Therefore, devices may wrongly add or update the MAC address of the IP address in their ARP cache.

MITRE ATT&CK, Adversary-in-the-Middle: ARP Cache Poisoning (T1557.002), checked September 2026
#arp#arp-cache-poisoning#t1557-002

Now you: practice questions

No account needed. The explanation opens when you answer.

Sample question 1 of 3

Network and Perimeter Hacking

An analyst finds a workstation whose ARP cache maps the gateway address to an unexpected MAC, although the workstation never sent a request for it. Which technique fits?

Sample question 2 of 3

Network and Perimeter Hacking

A network team must stop ARP cache poisoning at the access layer without configuring every host. Which pair of switch controls does that?

Sample question 3 of 3

Network and Perimeter Hacking

An engineer proposes pinning static ARP entries on every server and workstation to defeat cache poisoning. What limits this approach?

That’s 3 of the full CEH bank.

Keep going free: 10 questions per certification in bank practice, with no account.

Continue practicing

Read the sources

These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.

More objectives in Network and Perimeter Hacking