During a network audit, a MAC address change was observed. What is a likely explanation?

During a network audit, a MAC address change was observed. What is a likely explanation?

• A. The NIC was replaced
• B. The MAC address was spoofed
• C. The OS was updated
• D. DHCP lease renewed

Answer: (A)

A MAC address change during a network audit usually means the physical network interface card was replaced. MAC addresses are unique identifiers burned into the NIC hardware, so swapping in a new card brings a different address. Other options don’t fit as well: renewing a DHCP lease does not change the hardware address, and an OS update typically doesn’t alter the NIC’s MAC. MAC spoofing could cause a change, but that’s an intentional software-level action rather than a hardware replacement, and in an audit you’d normally verify a physical replacement first. So the observed change most plausibly indicates a NIC replacement.

A MAC address change during a network audit usually means the physical network interface card was replaced. MAC addresses are unique identifiers burned into the NIC hardware, so swapping in a new card brings a different address. Other options don’t fit as well: renewing a DHCP lease does not change the hardware address, and an OS update typically doesn’t alter the NIC’s MAC. MAC spoofing could cause a change, but that’s an intentional software-level action rather than a hardware replacement, and in an audit you’d normally verify a physical replacement first. So the observed change most plausibly indicates a NIC replacement.