Discuss Cisco 350-701 Exam Topic 6 Question 124

[Security Concepts]

Which IPS engine detects ARP spoofing?

AAtomic ARP Engine

BService Generic Engine

CARP Inspection Engine

DAIC Engine

Suggested Answer: A

The Atomic ARP engine is a signature engine that defines basic Layer 2 ARP signatures and provides more advanced detection of the ARP spoof tools dsniff and ettercap. ARP spoofing is an attack that involves sending spoofed ARP messages over a local area network to associate the attacker's MAC address with the IP address of the target. The Atomic ARP engine inspects the Layer 2 ARP protocol and compares the ARP requests and replies with the MAC address table to detect any anomalies or inconsistencies. The Atomic ARP engine can also detect gratuitous ARP messages, which are unsolicited ARP replies that can be used to poison the ARP cache of other hosts.The Atomic ARP engine is different from other IPS engines because most engines are based on Layer 3 IP protocol.Reference:=

https://www.cisco.com/c/en/us/td/docs/security/ips/6-1/configuration/guide/cli/cliguide/cli_signature_engines.html

https://security.stackexchange.com/questions/71023/can-suricata-ips-detect-and-prevent-arp-poisoning-attacks

Get Premium 350-701 Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

23 comments · newest first

Ernie 17 days ago

I feel confident about C). It’s a common topic in security.

Valentin 22 days ago

C) is definitely the best choice. It’s designed for that.

Virgie 27 days ago

A) Atomic ARP Engine sounds cool, but not for this.

Vesta 1 month ago

I was torn between A) and C). But C) feels right.

Joseph 1 month ago

Yeah, I agree. ARP spoofing needs specific inspection.

Jacquline 1 month ago

I think it's C) ARP Inspection Engine. Seems logical.

Elvera 2 months ago

B doesn’t fit ARP spoofing. Stick with C!

Jenelle 2 months ago

I’m leaning towards B) Service Generic Engine. Could be a trick!

Ellsworth 2 months ago

I remember studying this. C makes the most sense!

Fatima 2 months ago

C is definitely the best choice. It’s designed for that.

Sonia 2 months ago

No way, A is too basic for ARP spoofing.

Nichelle 2 months ago

I feel unsure about this one. What if it's A)?

Lynette 3 months ago

Agreed! ARP spoofing needs specific detection.

Selma 3 months ago

I think it's C) ARP Inspection Engine. Seems logical.

Leigha 3 months ago

AIC Engine? Never heard of that one for ARP issues.

Valda 3 months ago

Really? I didn't know ARP spoofing had a specific engine.

Nickie 3 months ago

Totally agree, ARP Inspection is the way to go.

Kindra 3 months ago

I thought it was the Atomic ARP Engine?

Yolando 4 months ago

It's definitely the ARP Inspection Engine!

Belen 4 months ago

I have a vague memory of the AIC Engine being related to ARP issues, but I can't remember the details.

Talia 5 months ago

I feel like I saw a practice question about ARP spoofing detection, and it mentioned the Service Generic Engine, but I don't think that's correct.

Bok 6 months ago

I remember studying about different IPS engines, but I can't recall if the Atomic ARP Engine was specifically for ARP spoofing.

Brittni 6 months ago

I think the ARP Inspection Engine sounds familiar, but I'm not entirely sure if it's the right one for detecting ARP spoofing.

Cisco 350-701 Exam - Topic 6 Question 124 Discussion