In a MAC flooding attack, the CAM table is overwhelmed. Which statement best describes the result?

In a MAC flooding attack, the CAM table is overwhelmed. Which statement best describes the result?

• A. The CAM table overflows and the switch stops learning new MACs.
• B. The switch uses a dedicated monitor port to mirror traffic.
• C. The CAM table overflows, causing the switch to broadcast to all ports.
• D. The switch ceases forwarding traffic.

Answer: (C)

When a switch’s CAM (MAC) table is overwhelmed, it can no longer map a destination MAC to a specific port. As a result, frames whose destination isn’t in the table are flooded out to all ports in the VLAN. This broadcast-like behavior means the attacker’s port can see traffic not meant for it, which is the essence of the MAC flooding effect. The statement that best describes the result is that the CAM table overflows, causing the switch to broadcast to all ports. The other scenarios don’t fit: the switch doesn’t stop learning or cease forwarding; the monitor port concept is unrelated to this outcome. To reduce risk, use port security to cap MAC addresses per port, segment networks with VLANs, and enable defenses that limit CAM table growth.

When a switch’s CAM (MAC) table is overwhelmed, it can no longer map a destination MAC to a specific port. As a result, frames whose destination isn’t in the table are flooded out to all ports in the VLAN. This broadcast-like behavior means the attacker’s port can see traffic not meant for it, which is the essence of the MAC flooding effect. The statement that best describes the result is that the CAM table overflows, causing the switch to broadcast to all ports. The other scenarios don’t fit: the switch doesn’t stop learning or cease forwarding; the monitor port concept is unrelated to this outcome. To reduce risk, use port security to cap MAC addresses per port, segment networks with VLANs, and enable defenses that limit CAM table growth.