Information Technology Specialist (ITS) Cybersecurity Practice Exam

In a DHCP spoofing attack, what do threat actors configure to issue DHCP addresses?

1. A fake router

2. A fake DHCP server

3. A fake firewall

4. A fake switch

The correct answer is: A fake DHCP server

In a DHCP spoofing attack, threat actors configure a fake DHCP server to issue DHCP addresses. This type of attack involves the malicious server responding to DHCP requests from clients on the network before the legitimate server has a chance to respond. By doing so, the attacker can assign IP addresses and other network configuration parameters (like gateway and DNS servers) that are controlled by them. The reason this method is effective is that DHCP is a trust-based protocol where clients typically accept the first DHCP offer they receive. If the fake server provides incorrect network configuration, it can lead clients to route their traffic through the attacker's machine, allowing for man-in-the-middle attacks, traffic interception, or even denial of service. The other options, while they involve network infrastructure, do not specifically relate to the mechanism of issuing DHCP addresses. A fake router or switch does not inherently provide DHCP services, and a firewall's primary role is to control access to network traffic rather than issuing IP configurations. Thus, the configuration of a fake DHCP server is precisely what enables the execution of a DHCP spoofing attack.