Which statement correctly describes ARP spoofing?

• A. ARP resolves IP to MAC addresses; ARP spoofing is sending forged ARP replies to associate attacker MAC with a victim IP
• B. ARP uses port numbers
• C. ARP encrypts data
• D. ARP is used for DNS

Answer: (A)

ARP translates IPv4 addresses to MAC addresses on the local network. ARP spoofing occurs when an attacker sends forged ARP replies to poison other devices’ ARP caches, causing them to associate the attacker’s MAC address with a legitimate IP (often a victim’s or the gateway’s). Once the cache is poisoned, traffic meant for that IP is sent to the attacker, enabling eavesdropping or tampering and potentially a man-in-the-middle.

That’s why this option is the best fit: it describes both how ARP operates (IP to MAC resolution) and how spoofing works (forged ARP replies to bind the attacker’s MAC to a victim’s IP). ARP doesn’t use port numbers (that’s a transport-layer concept), it isn’t about encryption, and it isn’t used for DNS.