ARP — end of module

What this checks. That you can say what ARP is for, what it cannot do, and why a correct routing table is still not enough to put a frame on a wire. You need 3 of 4 to pass, and every option is explained afterwards — including the ones you did not pick.

1. 1/4A laptop at 10.0.1.10/24 with gateway 10.0.1.1 opens a connection to 203.0.113.30. Whose MAC address does it ARP for?

   Identify the responsible endpoint

   10.0.1.1 — the gateway

   203.0.113.30 — the server

   Both, and it uses whichever answers first
2. 2/4What is the difference between an ARP cache entry and a routing table entry?

   Tell two ideas apart

   The ARP cache maps an IP address to a MAC on this segment; the routing table maps a destination prefix to a next hop

   The ARP cache is for local machines and the routing table is for the internet

   They hold the same information at different layers
3. 3/4A host's ARP cache shows the gateway's IP mapped to an attacker's MAC. Someone says 'that means the attacker broke ARP's authentication'. Why is that wrong?

   Say why an answer is wrong

   ARP has no authentication to break — a reply is believed because it arrived

   ARP authenticates by MAC address, and the attacker spoofed it

   The attacker must have compromised the gateway itself
4. 4/4A network you have never seen has two hosts with the same IP address configured on one segment. Both are up. What does ARP do?

   Apply it somewhere new

   Both answer the request, and the asker keeps whichever reply it processed last

   Neither answers, because each detects the other

   The switch blocks the second reply