N10-009 - Network Security (14% of the exam) - Section 4.2

Summarise common network attacks and their impact, including DoS/DDoS, on-path, spoofing, VLAN hopping, and social engineering.

Summarise the attack types a network defender must recognise: denial-of-service and distributed DoS, on-path (man-in-the-middle), ARP and DNS spoofing/poisoning, MAC flooding, VLAN hopping, and rogue access points. Match each attack to its impact and the layer it targets, and distinguish technical attacks from social-engineering techniques such as phishing and tailgating.

DoS/DDoSOn-path attacksARP/DNS poisoningVLAN hoppingSocial engineering

Practice question for this objective

Free sampleNetwork Securitymedium

Which statement correctly distinguishes DNS cache poisoning from ARP cache poisoning when each is used to set up an on-path attack?

ADNS cache poisoning works at Layer 2 inside a single broadcast domain, whereas ARP poisoning can redirect traffic across routed networks.
BBoth techniques require the attacker to already possess a valid TLS certificate for the target before traffic can be intercepted.
CARP poisoning corrupts hostname-to-IP resolution, while DNS poisoning corrupts the IP-to-MAC mappings held on the local segment.
DDNS poisoning corrupts hostname-to-IP resolution so a name resolves to an attacker address, while ARP poisoning corrupts IP-to-MAC mappings on the local segment. Correct

DNS poisoning falsifies hostname-to-IP resolution while ARP poisoning falsifies IP-to-MAC mapping on the local segment; both can redirect traffic to an on-path attacker. DNS poisoning and ARP poisoning both redirect victims, but they attack different resolution steps: DNS maps names to IP addresses, and ARP maps IP addresses to MAC addresses on the local link, so corrupting each has a different scope.

Why A is wrong: This reverses the two: ARP poisoning is the Layer 2 technique confined to the local broadcast domain, while DNS poisoning manipulates name resolution and is not bound to a single segment.

Why B is wrong: Neither technique depends on holding a certificate; this is tempting because certificates relate to interception defences, but ARP and DNS poisoning redirect traffic at the link and name-resolution layers regardless of TLS.

Why C is wrong: The two roles are swapped here; the labels look right individually, but ARP handles IP-to-MAC on the local link and DNS handles hostname-to-IP, so the statement inverts their functions.

Why D is correct: DNS poisoning falsifies name-to-address answers so victims connect to attacker-controlled hosts, whereas ARP poisoning falsifies the IP-to-MAC binding within the broadcast domain; the two operate at different layers of resolution.

See more N10-009 practice questions, answers explained.

Exam traps in Network Security

Answers that look right on this material and are not. Each one is a distractor from a different question in the N10-009 bank for this domain.

DNS cache poisoning of the local resolver
Why it is wrong: It is tempting because both attacks redirect a victim's traffic, but DNS poisoning corrupts name-to-IP resolution and would not rewrite a host's IP-to-MAC entry, and here the gateway IP itself is unchanged.
Port security limiting each port to one MAC
Why it is wrong: Port security is tempting because it hardens access ports, but capping the number of learned MAC addresses stops flooding and rogue devices rather than inspecting ARP payloads for forged IP-to-MAC bindings.
Port security, which restricts how many MAC addresses may be learned on an individual switch access port.
Why it is wrong: Port security limits MAC addresses per port and can curb MAC flooding, but it does not inspect the contents of ARP packets, so a forged ARP reply from an allowed host still poisons victims' caches.

Examworthy is not affiliated with or endorsed by CompTIA. Original, blueprint-aligned practice material only.