Ethical Hacking Essentials Practice Test

What happens when ARP cache is poisoned?

1. Legitimate IP addresses are blocked

2. Malicious IP addresses are mixed with legitimate ones

3. Traffic is denied entirely

4. Security protocols are bypassed

The correct answer is: Malicious IP addresses are mixed with legitimate ones

When ARP cache is poisoned, malicious IP addresses are mixed with legitimate ones, which allows an attacker to intercept or manipulate network traffic. This occurs because Address Resolution Protocol (ARP) relies on mappings between IP addresses and MAC addresses to direct packets within a local network. By poisoning the ARP cache, the attacker sends false ARP messages that associate their own MAC address with the IP address of another device, such as a router or another computer. As a result, traffic intended for the legitimate IP address is redirected to the attacker's device, posing significant risks such as man-in-the-middle attacks and data interception. The other options highlight misconceptions about the consequences of ARP poisoning. For example, blocking legitimate IP addresses doesn't accurately represent the mechanism at play, as poisoning rather involves redirecting traffic rather than outright blockages. Complete denial of traffic is also not a characteristic of ARP poisoning—it is more focused on redirection rather than cessation of traffic flow. Lastly, while security protocols could theoretically be circumvented as a consequence of poisoned ARP caches, it's more precise to describe the immediate effect as the mixing of misleading IP addresses with legitimate ones, enabling malicious activities.