In the context of ARP spoofing, what is the attacker primarily attempting to achieve?

• A. Gaining unauthorized access to a remote network
• B. Flooding the network with ARP requests
• C. Poisoning ARP tables to intercept traffic
• D. Cracking passwords stored in ARP table

Answer: (C)

ARP spoofing targets the local mapping of IP addresses to MAC addresses. By sending forged ARP messages, the attacker tricks nearby devices into updating their ARP cache so that the attacker’s MAC address is associated with a legitimate IP (often the gateway or another trusted host). Once the cache is poisoned, traffic intended for that IP is sent to the attacker, allowing interception, eavesdropping, or even modification of the data as it passes through. This is the essence of a man-in-the-middle position on the LAN.

That’s why this option is the best fit: it directly describes poisoning ARP tables to intercept traffic. The other ideas don’t align with ARP spoofing’s main goal—ARP tables don’t store passwords, and while a flood of ARP requests can occur, the primary objective of ARP spoofing is to redirect traffic, not simply to overwhelm the network.