Network Security (NETSEC) 4 Practice Test

Lack of authentication in ARP messages allows ARP spoofing. The Address Resolution Protocol maps IP addresses to MAC addresses by broadcasting requests and accepting replies, but there is no built-in mechanism to verify who sent an ARP reply or to ensure the information is legitimate. Because ARP lacks cryptographic authentication, an attacker on the same local network can send forged ARP replies that falsely claim ownership of an IP address (for example, the gateway’s IP) and associate it with the attacker’s MAC address. Once devices cache this bogus mapping, traffic intended for the legitimate host goes to the attacker, enabling interception or manipulation.

The other options don’t fit because ARP has no standard field for IPsec, encryption, or digital signatures. ARP was designed for simplicity on local networks and does not include cryptographic protections, making spoofing possible whenever there’s no authentication. Defense typically involves measures like dynamic ARP inspection, static ARP entries, or switching controls to limit who can send ARP responses.