VLAN Hopping Attack Scenario Analysis
Short answer
C VLAN hopping best describes the attack because it enables an attacker on an isolated guest VLAN to bypass Layer 2 segmentation and communicate directly with an internal server on a different VLAN.
Question
Key Takeaways
The trap is confusing intra-VLAN attacks like ARP spoofing with inter-VLAN attacks; VLAN hopping is the only option that crosses VLAN boundaries.
This question tests knowledge of Layer 2 attacks that bypass VLAN isolation. VLAN hopping (C) is the correct answer as it allows traffic to cross from an isolated guest network to an internal server subnet.
Common mistake: ARP spoofing (D) is often chosen because it is a common MITM attack, but it only works within a single broadcast domain (VLAN) and cannot explain how the attacker reached the internal server from the isolated guest network.
Expert Analysis
The scenario describes a lateral movement attack where an attacker located on an isolated guest network gains access to an internal server. The key constraint is the isolation between these two distinct logical networks, which are typically separated by VLANs at Layer 2.
VLAN hopping (Option C) is the specific attack vector designed to bypass this isolation. It occurs when an attacker on one VLAN manages to send traffic to another VLAN without traversing a router or firewall. Common methods include double-tagging 802.1Q frames or exploiting Dynamic Trunking Protocol (DTP) negotiations. This directly explains how someone on an 'isolated guest network' can reach an 'internal server' that should be unreachable from that segment.
ARP spoofing (Option D) allows an attacker to intercept traffic within the same broadcast domain (the same VLAN). While it facilitates man-in-the-middle attacks, it does not inherently allow traffic to cross VLAN boundaries. Therefore, it cannot explain connectivity between the guest and internal networks unless combined with a layer-crossing technique like VLAN hopping.
On-path (Option A) is a general term for interception attacks but lacks the specificity of VLAN traversal required by the scenario's mention of isolated networks. DNS poisoning (Option B) affects name resolution records, not direct Layer 2/Layer 3 connectivity paths between isolated subnets.
As noted in community discussions, while some users argue for ARP spoofing due to its prevalence in labs, VLAN hopping is the only mechanism listed that specifically bridges isolated VLAN segments.
Exam Strategy
When you see keywords like 'isolated,' 'guest network,' 'restricted VLAN,' or 'bypass segmentation,' think about Layer 2 traversal attacks first. If the question implies moving between different logical networks that should be separated, look for VLAN hopping or trunk exploitation. Reserve ARP spoofing for scenarios where the attacker and victim are already in the same subnet and the goal is traffic interception rather than initial access across segments.
Frequently Asked Questions
Why isn't ARP spoofing the answer if it's used to intercept traffic?
What is the most common method for VLAN hopping?
Discussion 3 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 3
-
ERB14 👍 1 Answered CVLAN Hopping: An attack vector where an attacker on a restricted or isolated VLAN (such as a guest network) bypasses Layer 2 security controls to access traffic on other restricted VLANs (such as internal server subnets). Common techniques include double-tagging 802.1Q frames or spoofing Dynamic Trunking Protocol (DTP) messages.
-
smittywerbenjagermanjensen 👍 1 Answered CI'm pretty certain Skri113xX is either a bot or just guessing. VLAN hopping would be how they got from the guest network to the internal network.
-
Skri113xX 👍 1 Answered DWithout a doubt, it's D. This came up in a recent lab I did.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All N10-009 Questions
Access 100 questions with complete answers and detailed explanations.
View Full N10-009 Practice Test →