CompTIA Network+ Practice Test

What is the primary consequence of an attacker initiating MAC flooding?

1. The switch effectively operates as a router

2. The switch becomes slow and unresponsive

3. The switch will only forward traffic to certain VLANs

4. The switch will broadcast traffic to all devices

The correct answer is: The switch will broadcast traffic to all devices

When an attacker initiates MAC flooding, the intention is to overwhelm the switch's MAC address table. Switches maintain this table to efficiently direct traffic only to the appropriate ports based on the MAC addresses of devices connected to it. When the MAC address table is flooded with bogus entries, the switch reaches its capacity and can no longer learn new MAC addresses. As a result, the switch's method of operation changes. Instead of forwarding frames based solely on the learned MAC addresses, it goes into a failsafe mode where it broadcasts incoming traffic to all devices in the same broadcast domain. This behavior allows the attacker to potentially intercept sensitive data, as they can capture the broadcasted packets meant for other devices. Thus, the primary consequence of MAC flooding is that the switch will broadcast traffic to all devices, undermining its ability to maintain a secure and efficient networking environment.