FirstTry

Objective 4.2

N10-009

Summarize various types of attacks and their impact to the network.

Objective 4.2 sits in Network Security, which carries 14% of the Network+ exam. The questions below are original, written from the official objective title above, and each explanation cites the CompTIA page it rests on.

Objective title verbatim from the official objectives. CompTIA exam page ↗

A worked example

Shown solved, with the whole explanation open: this is what every question here carries.

4-2Network Security

Two workstations on the same VLAN keep full connectivity, but both show the gateway IP mapped to a third host's MAC address, and that host is forwarding their traffic onward. Which attack matches this behavior?

MAC address table overflow on the access switchA flooded address table makes the switch send unknown unicast out every port, which would show as traffic the workstations never asked for.
ARP cache poisoning placing the attacker on pathCorrect · your answerCorrect. Forwarding the intercepted frames onward is what keeps the attack invisible.
Rogue DHCP server issuing a false default gatewayA false gateway handed out in a lease shows a wrong gateway IP on the client, not the right IP with the wrong MAC.
DNS cache poisoning redirecting name lookupsBad name resolution sends a client to the wrong address entirely. Here the address is right and the mapping under it is wrong.

Correct.

Checked against cisco.com, August 2026

Concept

Layer 2 address resolution has no way to check that a reply comes from the true owner of an address, so a host will believe a forged binding and keep working normally. Interception that preserves connectivity is the hardest kind to notice, because nothing breaks.

Why B

Forged replies overwrite the gateway binding in both caches, so frames meant for the gateway are delivered to the attacker instead. Knowing the real hardware addresses, the attacker relays those frames to their real destination, which is why neither user sees a failure.

Source

Host C can poison the ARP caches of the switch, Host A, and Host B by broadcasting forged ARP responses with bindings for a host with an IP address of IA (or IB) and a MAC address of MC. Hosts with poisoned ARP caches use the MAC address MC as the destination MAC address for traffic intended for IA or IB. This means that Host C intercepts that traffic. Because Host C knows the true MAC addresses associated with IA and IB, it can forward the intercepted traffic to those hosts by using the correct MAC address as the destination. Host C has inserted itself into the traffic stream from Host A to…

Cisco Catalyst 9300 security guide: Understanding Dynamic ARP Inspection, checked August 2026
#arp-spoofing#on-path-attack#layer2

Now you: objective 4.2 questions

No account needed. The explanation opens when you answer.

Sample question 1 of 3

4-2Network Security

A host that never sent an ARP request still updates its cache when an unsolicited ARP reply arrives on the segment. Which property of the protocol makes that possible?

Sample question 2 of 3

4-2Network Security

Someone plugs a small switch into an access port configured for PortFast with BPDU guard enabled. The port receives a BPDU from the new device. What happens to that port?

Sample question 3 of 3

4-2Network Security

On an IPv6 segment, forged advertisements set the router lifetime of every legitimate router to zero. Clients then send all traffic, on-link and off-link, to one unexpected node. What does the intruder gain?

Full Network+ question bank coming

We’re writing the complete bank from the official objectives right now. Leave your email and we’ll tell you when it ships, nothing else, ever.

Read the sources

These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.

More objectives in Network Security