Answer: B Keyword: "...determine if there is an unauthorized user on the network" The question is not looking for resolution, it does not ask to deny to prevent but determine and identify unauthorized users. Since this is a home network, and 4 devices are plugged on. The best next course of action is to physically check devices to find out which is legit.

B. "The NEXT step to DETERMINE if there is an unauthorized user" - if the hacker spoofed one of the MACs, then the MAC filter info is meaningless - the router thinks its authorized. My router shows my smart tv as "Unknown" but it's authorized by me. The only way to see if one of the MACs was spoofed is to shut off all of the known devices (Mom, Dad, Junior, and the smart tv) then check to see if one of the connections is still active. If so, then that MAC is being spoofed.

A user suspects someone has been accessing a home network...home network is the key term here...small network with limited client that can be physically checked.

AND JR PC is on a separate sub net...WTF...192.168.2.16?????

Question must be worded wrong...why is the filter on for dad and jr? this means they cant be on the network, so it would do the attacker no good to spoof those two? I am confused,,,I am sure it is not "deny unknown tho...but Lead2Pass list that answer as correct and they claim 96% accuracy and charged me 100$

Dude...you think he is spoofing...so if he is there, he will be spoofing either MOM DAD or JR...if you physically see one of them is offline, you know they are spoofed

Does nobody find it funny that one of the answers basically wants you to ping the attacker. Like hey man, you there bro, please respond.

It is B. You have to read carefully. We are just checking if a user is on the network and not denying or taking steps to remove the user from the network.

how could i Physically check each of the authorized systems ?!!!

I just received an update for a prep test and there is another question like this but the answer is D for conducting a ping sweep. If you are at home its simple to check all the home computers. I have done that before.

The "Unknown" doesnt mean it is the attacker... Watch out on the exam

Answer: B Explanation: Can't be A or C because the question suggests the mac address is spoofed which can bypass the filter. D would be pointless.

I think the real key word is that the user suspects someone has been spoofing a MAC address, so MAC filtering does not really work. So the correct answer would be B.

other sources are saying C therefore it is C

So if i apply MAC filtering with all of my known devices, and it drops the unknown (because I label my devices), wouldn't that identify it. Probably... Or I could walk all over the house to physically see if the computer is logged in, paying no attention the MAC, and ultimately doing nothing to prevent a second attack.

It's SHSO so, limited devices are their that's why best answer in A.

I think it is physically check each system.