Back to IP Addressing

Address Resolution Protocol (ARP)

5 minutes 5 Questions

Address Resolution Protocol (ARP) is a network protocol used in IP networks to map an IP address to its corresponding physical or MAC (Media Access Control) address. When a network device wants to communicate with another device in the same network, it needs to know the MAC address of the destinati…

Test mode:
Start practice test
CompTIA Network+ - Address Resolution Protocol (ARP) Example Questions

Test your knowledge of Address Resolution Protocol (ARP)

Question 1

A network administrator wants to find the MAC address of a device with the IP address 192.168.1.10. Which ARP command would they use to achieve this?

Correct Answer: arp -a 192.168.1.10

The correct command to find the MAC address of a device with a given IP address, in this case 192.168.1.10, is 'arp -a 192.168.1.10'. The '-a' parameter after arp displays the current ARP entries by interrogating the current protocol data. The wrong commands either used wrong parameters such as /a, -A, and -m or placed the parameters in the wrong location of the command. For instance, 'arp 192.168.1.10 /a' is incorrect because the /a is not a valid parameter. Similarly, 'arp -A 192.168.1.10' and 'arp -m 192.168.1.10' are incorrect because -A and -m are not valid arp command parameters.

Question 2

A network administrator has received an alert of a potential ARP spoofing attack. What should the administrator do to prevent the attack?

Correct Answer: Enable Dynamic ARP Inspection

The most effective measure against an ARP spoofing attack would be to enable Dynamic ARP Inspection. This feature verifies ARP requests and responses that are traversing the network based on a secure DHCP binding database or on the static ARP access control list. This aims to block those that are invalid, hence minimizing the chance of a successful ARP spoofing attack. Although methods like disabling ICMP echo requests, enabling DHCP snooping or configuring a port security are prominent cybersecurity practices, they are not specifically effective against ARP spoofing attacks. Hence, these answers are incorrect in the context of this question.

Question 3

A server experiences intermittent loss of connectivity. You suspect ARPs are not working properly. Without disrupting users or the network, what is an appropriate method to test if the issue is caused by ARP?

Correct Answer: Perform a packet capture and analyze the ARP traffic

The best method to test if the issue is caused by ARP (Address Resolution Protocol) without disrupting users or the network, is to perform a packet capture and analyze the ARP traffic. This would allow you to see if there are any anomalies or irregularities with the ARP requests or responses, such as incorrect IP-to-MAC address mappings, which could be the cause of the intermittent loss of connectivity. Resetting network devices to clear the ARP cache does not provide a way to diagnose and identify any ARP-related issues. It may temporarily alleviate the problem but doesn't provide insight into what's causing the issue. Disabling the server's network adapter would disrupt the network service, which is not desired in this scenario. Enabling promiscuous mode on the switches is not a valid test for detecting ARP specific issues. It simply allows a network device to intercept and read each network packet that arrives in its entirety, regardless of the destination address.

More Address Resolution Protocol (ARP) questions
11 questions (total)
Start 11 question test