At a bank, a workstation answers ARP for the gateway address and then starts receiving frames that were meant for the gateway. What class of attack is this behavior?
Select an answer to reveal the explanation.
Short Explanation
Someone wearing the landlord's name tag collects the landlord's mail. You are seeing ARP spoofing, a protocol-based on-path attack, because the workstation answers for the gateway and takes its frames. The trap is calling that a distributed flood, SQL injection, or a ransomware note.
Full Explanation
On-path interception redirects traffic so the attacker receives frames meant for someone else. ARP is the protocol hosts use to map a local address to a link-layer destination. A workstation that answers ARP for the gateway address, and then receives frames meant for the gateway, is claiming that gateway identity. The class is A protocol-based on-path attack: the workstation answers ARP for the gateway address. That is protocol abuse used to sit on the path. It is not a loss of capacity and it is not an application exploit. A distributed flood: many outside sources overwhelm the gateway at the same time would be many sources exhausting a service, and the scenario describes one workstation answering ARP. SQL injection against a bank web form that this workstation was busy answering is an application attack on a query, and nothing here describes a database statement. A ransomware note shown after the workstation started claiming the gateway address adds an extortion message the scenario never mentions. Receiving redirected frames is not a ransom event. Exam caveat: on-path protocol abuse and a distributed denial of service are different classes, even when both involve the gateway. Operational check: compare the ARP entry for the gateway address with the gateway's real interface and look for this workstation answering in its place.