Man-in-the-Middle (MITM) attack

A Man-in-the-Middle attack positions the attacker inline between two parties who believe they are communicating directly. The attacker relays every message, reading and optionally altering it in transit, and can substitute their own keys during an unauthenticated key exchange so that each victim unknowingly encrypts to the attacker. Classic footholds include ARP poisoning on a LAN, rogue wireless access points, and DNS spoofing; modern exam language increasingly calls this whole class an on-path attack.

The defence is authentication of the endpoints, not encryption alone: an unauthenticated Diffie-Hellman exchange is textbook MITM bait, because neither side proves who it is. Mutual authentication forces both parties to prove their identity, proper certificate validation stops an attacker presenting a forged certificate, and certificate pinning rejects even a valid certificate if it comes from the wrong issuer.

Exam relevance: an attacker relaying or altering live traffic between two parties is the trigger, and the answer is MITM (on-path attack). If the fix in the scenario is mutual authentication or certificate checks, same answer. The confusable is the replay attack: replay captures legitimate traffic and resends it later to gain access, with no live inline position, while MITM sits inside the conversation as it happens.