Exam SY0-701 topic 1 question 565 discussion

C. Insider threat Explanation: ARP poisoning (or ARP spoofing) involves sending fake Address Resolution Protocol (ARP) messages onto a local network, which can cause network traffic to be misdirected or intercepted. The analyst’s discovery of the attack and their immediate response to terminate access indicates that someone may be intentionally disrupting the network. Given the context that the attack is occurring during a sensitive time (state testing) and considering that the attacker was able to execute such an attack and cause significant disruption, it's likely that the attacker has access to the internal network and knowledge of its operation, which aligns with an insider threat. Insiders, whether employees, contractors, or others with network access, are often responsible for these types of attacks.