Which Attack Overflows a Switch's CAM Table?
As part of an attack, a threat actor purposefully overflows the content-addressable memory (CAM) table on a switch. Which of the following types of attacks is this scenario an example of?
Community Votes
100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The exam tests your ability to match attack names to their specific switch-level behavior: MAC flooding targets the CAM table, while ARP spoofing targets the ARP cache, and evil twin targets Wi-Fi clients.
MAC flooding is the network attack that overflows a switch's content-addressable memory (CAM) table, causing the switch to fail open like a hub. Community consensus confirms answer C is correct for this N10-009 exam question.
Choosing ARP spoofing is a common mistake because both attacks involve network traffic interception, but ARP spoofing poisons the ARP cache, not the CAM table.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
MAC flooding is a Layer 2 attack where an attacker sends a large number of fake Media Access Control (MAC) addresses to fill the switch's Content-Addressable Memory (CAM) table. Once the CAM table is full, the switch can no longer learn or store legitimate MAC addresses, so it falls back to flooding unknown unicast frames out all ports, behaving like a hub. This allows the attacker to sniff traffic that was not originally destined to their port. Comments from users note that "CAM is within the MAC...CAM is MAC backwards" as a memory aid, and another comment explicitly states that MAC flooding targets the switch's CAM table by overwhelming it with fake MAC addresses.Why the Other Options Are Wrong
ARP spoofing is incorrect because it involves sending forged Address Resolution Protocol (ARP) messages to poison the ARP cache of hosts, redirecting traffic at the IP-to-MAC mapping level, not by overflowing switch memory. Evil twin is incorrect because it is a wireless attack where an attacker sets up a rogue access point with a legitimate-looking SSID to steal credentials or intercept Wi-Fi traffic. DNS poisoning is incorrect because it corrupts DNS resolver caches to redirect domain names to malicious IP addresses, affecting name resolution rather than switch forwarding tables. All three options are distinct attack types that do not describe the act of overflowing a switch's CAM table.Community Comment Notes
Community discussion is unanimous in selecting C, MAC flooding. One commenter suggests a mnemonic: "CAM is within the MAC....CAM is MAC backwards." Another commenter provides a direct definition: MAC flooding is a network attack that specifically targets a switch's Content-Addressable Memory (CAM) table by overwhelming it with fake MAC addresses. A third commenter explains the consequence: the switch fails and behaves like a hub, enabling the attacker to capture sensitive data through traffic interception. These comments reinforce the textbook definition and align with CompTIA Network+ objectives.Official Reference
Exam Strategy
When you see a question about overflowing a switch's memory table, immediately think MAC flooding. Remember the distinction: ARP poisoning redirects traffic between hosts, while MAC flooding exhausts switch resources to force hub-like behavior—this contrast is a favorite on the Network+ exam.
Related Analysis
Practice All N10-009 Questions
Access 100 questions with complete answers and detailed explanations.
View Full N10-009 Practice Test →