This document discusses ARP spoofing, Man-in-the-Middle (MITM) attacks, and the network monitoring tool Wireshark. It addresses 15 multiple choice questions on these topics, providing explanations for each answer. Key points covered include: how ARP spoofing works, the goal of MITM attacks is to steal login credentials and other sensitive data, and that Wireshark can be used to monitor network traffic using various protocols like Ethernet, WLAN, and Bluetooth.

1. ARP spoofing is the process of linking MAC address with…………….. a. DNS Server b. IP Address c.
Client server d. All of the above.
ARP spoofing is the process of linking MAC address with an IP address. Therefore, the answer is
option (b).
Q2. Which of the following device use ARP to contact? a. Router b. Gateway c. Both a & b. d.
None of the above.
Both routers and gateways use ARP (Address Resolution Protocol) to contact other devices on a
network. Therefore, the answer is option (c) - Both a & b.
Q4. Which of the following IP used for ARP spoofing? a. Default Gateway b. Subnet Mask c. IPv6
Address d. None of the above.
In ARP spoofing, an attacker sends false ARP messages to link the attacker's MAC address with
the IP address of another device on the network. Therefore, the attacker can use any IP address
on the network, but commonly the attacker will use the IP address of the default gateway or
another device on the network to perform the attack. Thus, the answer is option (a) - Default
Gateway.
Q5. Under which protocol type arp captured packets shown in wire shark application? a. IPv6 b.
IPv4 c. Both a & b d. None of the above.
ARP (Address Resolution Protocol) captured packets are shown under the IPv4 protocol type in
Wireshark application. Therefore, the answer is option (b) - IPv4.
Q7. On which of the following network standards wire shark offers network monitoring? a.
Ethernet b. Wlan c. Bluetooth d. All of the above.
Wireshark offers network monitoring on various network standards, including Ethernet, WLAN
(Wireless Local Area Network), Bluetooth, and many others. Therefore, the answer is option (d) -
All of the above.
Q8. In MITM attack the goal of an attack is to steal………………… a. login credential b. account
details c. credit card numbers d. All of the above
In a Man-in-the-Middle (MITM) attack, the attacker's goal is to intercept and manipulate
communication between two parties and steal sensitive information, such as login credentials,
account details, credit card numbers, or other valuable data. Therefore, the answer is option (d) -
All of the above.
Q9. MITM attacks are carried out through a two-step process known as data interception and
decryption. a. True b. False
False.

2. MITM attacks are not carried out through a two-step process known as data interception and
decryption. Rather, they involve intercepting and manipulating communication between two
parties, often by intercepting and altering data packets as they pass between the two parties. The
attacker can use various techniques to intercept the communication, such as ARP spoofing, DNS
spoofing, or other methods. Once the attacker has intercepted the communication, they can then
manipulate the data or steal sensitive information.
Q10. Choose correct option which displays username & password in the wire shark application?
a. Get /login.php HTTP/1.1 b. Post /userinfo.php c. Put /status HTTP/1.1 d. None of the above.
The correct option that displays username and password in the Wireshark application is option
(b) - POST /userinfo.php. The HTTP POST method is commonly used to submit login credentials
and other sensitive data to a web server, and the data may be transmitted in the body of the
HTTP request. Therefore, capturing the HTTP POST request can reveal the username and
password.
Q11. Originally wire shark was named Ethereal. a. True b. False
True.
WireShark was originally named Ethereal. It was created in 1998 by Gerald Combs, who initially
named it Ethereal. The name was changed to Wireshark in 2006 due to trademark issues.
Q12. In which of the following year wire shark was introduced? a. 2006 b. 1990 c. 2000 d. None of
the above.
WireShark was introduced in the year 1998.
Q13. A Man in the Middle Attack is……………… a. Malicious software (Virus, Trojans, Spyware). b.
Intercepting data when it is sent. c. Taking down a website by flooding it with data and traffic. d.
Gaining unauthorized access to a computer.
A Man-in-the-Middle (MITM) Attack is a type of cyber attack where an attacker intercepts and
manipulates communication between two parties to steal sensitive information or to perform
other malicious activities. Therefore, the answer is option (b) - Intercepting data when it is sent.
Q14. Once the user logs into the insecure website, the attacker retrieves the user's information
and redirects them to a fake website. a. True b. False
True.
In a phishing attack, the attacker often sets up a fake website that looks similar to a legitimate
website and tricks the user into entering their login credentials. Once the user logs into the fake
website, the attacker retrieves the user's information and can redirect them to a fake website or
the legitimate website to avoid detection. Therefore, the statement is true.

3. Q15. What are the types of man in the middle attacks? a. IP spoofing b. HTTPS spoofing c. ARP
spoofing d. All of the above.
There are several types of Man-in-the-Middle (MITM) attacks, including:
a. IP Spoofing - where the attacker spoofs or forges IP addresses to redirect traffic to a different
destination than intended.
b. HTTPS Spoofing - where the attacker sets up a fake website with a valid SSL/TLS certificate to
intercept and decrypt encrypted traffic between the user and the legitimate website.
c. ARP Spoofing - where the attacker sends fake Address Resolution Protocol (ARP) messages to
link the attacker's MAC address with the IP address of another device on the network.
Therefore, the answer is option (d) - All of the above.