A city asks whether ARP spoofing on a production VLAN is an acceptable default pivot method. What is the sound judgment?
Select an answer to reveal the explanation.
Short Explanation
ARP spoofing on a live VLAN is like yanking network cables to see who complains—it can work, and it can also spill coffee on production. Default to calmer forwards and tunnels. Save disruptive MITM for cases where the RoE explicitly green-lights the mess.
Full Explanation
If a city asks whether ARP spoofing on a production VLAN is an acceptable default pivot method, the sound judgment is to prefer least-impact forwards or tunnels; disruptive MITM generally needs explicit RoE approval. ARP spoofing is not always safer than SSH because it leaves no logs—it can disrupt networking and is often highly visible to monitoring. Production VLANs do not implicitly allow any MITM once a foothold exists. Replacing all pivots with broadcast storms to map hosts faster is actively harmful. Exam caveat: default to low-disruption channels unless RoE explicitly authorizes poisoning or MITM classes. Operational check: review RoE for MITM language, choose SSH/forward/tunnel alternatives first, and if ARP techniques are truly required, obtain written approval and schedule a controlled window with the city network team. In municipal operations, record the rationale in the engagement notes so future testers and city defenders understand which approach was chosen and which failure modes the rejected options would create for civic services. Re-validate the same judgment after the next change window so the control still holds under the city’s current tooling, identity posture, and RoE amendments.