Which Attack Uses Multiple Network Tags in a Packet?
Short answer
B VLAN hopping
Question
Key Takeaways
The exam tests your knowledge of 802.1Q frame manipulation, with the common trap being confusion between VLAN hopping techniques and other Layer 2 attacks like MAC flooding or ARP poisoning.
VLAN hopping is a Layer 2 attack that leverages packets with multiple 802.1Q tags to bypass switch security and access unauthorized networks. Community consensus strongly confirms double tagging as the primary method tested on the N10-009 exam.
Common mistake: Candidates often select MAC flooding because it also targets switching hardware, but MAC flooding overwhelms CAM tables to cause broadcast storms rather than exploiting stacked VLAN tags to route across network boundaries.
Expert Analysis
Why the Answer Is Correct
VLAN hopping specifically relies on double-tagging, where an attacker crafts a frame with two 802.1Q headers. The outer tag matches the native VLAN of the trunk link, allowing it to pass through, while the inner tag directs traffic to the target VLAN once it reaches the destination switch. This technique directly exploits how switches process tagged frames on trunk ports, making it the only option that fits the multiple network tags description.
Why the Other Options Are Wrong
MAC flooding targets the switch's Content Addressable Memory table to force the device into fail-open mode, not by using multiple tags. DNS spoofing corrupts name resolution data at the application layer, completely unrelated to Layer 2 framing. ARP poisoning manipulates address resolution mappings to intercept traffic, relying on gratuitous ARP requests rather than stacked VLAN headers.
Community Comment Notes
The voting community unanimously selected VLAN hopping, with top-rated comments explicitly linking the attack to double tagging and switch spoofing mechanisms. Users frequently note that recognizing multiple tags or 802.1Q encapsulation in exam questions should immediately trigger VLAN hopping as the correct choice. This aligns perfectly with official CompTIA objectives for securing network infrastructure.
Official Reference
https://www.ieee802.org/1/pages/802.1Q.html
This link opens the official vendor documentation in a new tab.
Exam Strategy
When you see keywords like multiple tags, double tagging, or 802.1Q encapsulation in N10-009 questions, immediately associate them with VLAN hopping. Memorize the distinction between switch spoofing and double tagging to quickly eliminate distractors during the exam.
Community Votes
100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 4 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 4
-
HeatSquad77 👍 3 Answered BB. VLAN hopping A Layer 2 attack that enables an attacker to access hosts on a VLAN the attacker is not a part of. Traditionally this attack used switch spoofing or double tagging.
-
chupapi_001 👍 2 Answered BThe correct answer is B: VLAN hopping
-
chrys 👍 1VLAN hopping, baby!
-
bg5850 👍 1 Answered BLets Goo Vlan Hop
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All N10-009 Questions
Access 100 questions with complete answers and detailed explanations.
View Full N10-009 Practice Test →