CompTIA PenTest+ (PT1-002) — Question 16

A consultant is reviewing the following output after reports of intermittent connectivity issues:
? (192.168.1.1) at 0a:d1:fa:b1:01:67 on en0 ifscope [ethernet]
? (192.168.1.12) at 34:a4:be:09:44:f4 on en0 ifscope [ethernet]
? (192.168.1.17) at 92:60:29:12:ac:d2 on en0 ifscope [ethernet]
? (192.168.1.34) at 88:de:a9:12:ce:fb on en0 ifscope [ethernet]
? (192.168.1.136) at 0a:d1:fa:b1:01:67 on en0 ifscope [ethernet]
? (192.168.1.255) at ff:ff:ff:ff:ff:ff on en0 ifscope [ethernet]
? (224.0.0.251) at 01:02:5e:7f:ff:fa on en0 ifscope permanent [ethernet]
? (239.255.255.250) at ff:ff:ff:ff:ff:ff on en0 ifscope permanent [ethernet]
Which of the following is MOST likely to be reported by the consultant?

Answer options

• A. A device on the network has an IP address in the wrong subnet.
• B. A multicast session was initiated using the wrong multicast group.
• C. An ARP flooding attack is using the broadcast address to perform DDoS.
• D. A device on the network has poisoned the ARP cache.

Correct answer: D

Explanation

The correct answer is D because the presence of duplicate IP addresses associated with different MAC addresses indicates that a device may be manipulating the ARP cache. Options A, B, and C are less likely since they do not directly correlate with the evidence of ARP poisoning seen in the output.