Certified Ethical Hacker (CEH v13) — Question 249

In a large organization, a network security analyst discovered a series of packet captures that seem unusual. The network operates on a switched Ethernet environment. The security team suspects that an attacker might be using a sniffer tool. Which technique could the attacker be using to successfully carry out this attack, considering the switched nature of the network?

Answer options

• A. The attacker might be compromising physical security to plug into the network directly.
• B. The attacker might be implementing MAC flooding to overwhelm the switch's memory.
• C. The attacker is probably using a Trojan horse with in-built sniffing capability.
• D. The attacker might be using passive sniffing, as it provides significant stealth advantages.

Correct answer: B

Explanation

The correct answer is B, as MAC flooding can cause a switch to behave like a hub, allowing the attacker to capture traffic. Option A is incorrect because direct physical access is not necessary for this specific attack method. Option C is not relevant since a Trojan horse is not needed to conduct a sniffing attack in a switched environment. Option D, while it describes a legitimate technique, does not apply to the scenario where MAC flooding is the method being exploited.