A penetration tester successfully gained access to a company’s network. The investigating analyst determines malicious traffic connected through the WAP despite filtering rules being in place. Logging in to the connected switch, the analyst sees the following in the ARP table:
10.10.0.33 a9:60:21:db: a9:83
10.10.0.97 50:4f:b1:55:ab:5d
10.10.0.70 10:b6:a8:1c:0a:53
10.10.0.51 50:4f:b1:55:ab:5d
10.10.0.42 d5:7d:fa:14:a5:46
Which of the following did the penetration tester MOST likely use?
ARP poisoning
MAC cloning
Man in the middle
Evil twin
