An engineer analyzes a packet capture and observes ARP replies arriving without corresponding ARP requests. This behavior is indicative of what process or attack?
Answers
ADHCP discover
BICMP redirect
CDNS recursion
DGratuitous ARP or ARP spoofing
Correct answer: D — Gratuitous ARP or ARP spoofing
Gratuitous ARPs are sent without requests to update neighbor caches (e.g., for HA failover), but they can also be used maliciously for ARP spoofing (poisoning).
MIFOTRA exam practicealigned to Cisco CCNA 200-301·4 marks·Hard