1D0-61C · Question #1
Which type of attack involves the installation of malicious code on personal computers or servers that redirects Internet traffic from a legitimate Web site to an identical-looking but malicious…
The correct answer is A. Pharming. Pharming is correct because it specifically involves compromising DNS settings or injecting malicious code that silently redirects users from a legitimate URL to a fraudulent, look-alike site - the user types the correct address but lands on the attacker's server. Spoofing is a…
Question
Which type of attack involves the installation of malicious code on personal computers or servers that redirects Internet traffic from a legitimate Web site to an identical-looking but malicious imposter Web site?
Options
- APharming
- BSpoofing
- CPhishing
- DReplay
How the community answered
(34 responses)- A91% (31)
- B6% (2)
- C3% (1)
Explanation
Pharming is correct because it specifically involves compromising DNS settings or injecting malicious code that silently redirects users from a legitimate URL to a fraudulent, look-alike site - the user types the correct address but lands on the attacker's server. Spoofing is a broader term for impersonating an identity (IP, email, caller ID) but doesn't specifically involve code installation or DNS redirection. Phishing relies on deceptive emails or links to trick users into voluntarily visiting a malicious site - it's social engineering, not silent redirection. Replay attacks capture and retransmit valid network traffic (like authentication tokens) to gain unauthorized access, which has nothing to do with fake websites.
Memory tip: Think "Pharming = Farm - attackers harvest victims at scale by poisoning the DNS 'soil,' redirecting entire herds of users without them clicking anything suspicious."
Topics
Community Discussion
7
Naledi M.May 28, 2026Pharming is correct because it specifically involves compromising DNS settings or installing malware that silently redirects users from a legitimate URL to a fraudulent but visually identical site, no user click on a bad link required. The other options are close neighbors but distinct, spoofing fakes an identity at the network layer, phishing tricks users into clicking deceptive links, and replay attacks reuse captured authentication data.
Orla P.May 30, 2026Solid breakdown, and the "no click required" distinction is the one that trips people up most on exam day, though worth noting that pharming can also hit at the hosts file level, not just DNS, so if your question stem mentions a compromised local machine rather than a poisoned DNS server, the mechanism is the same but the scope is narrower.
Luis F.May 12, 2026Pharming is the one you want here, and it trips people up because it sounds similar to phishing. The key difference is that phishing tries to trick YOU into clicking a bad link, but pharming messes with the DNS or puts malware on your machine so that even if you type the correct URL yourself, you still get redirected to the fake site. The attacker poisons the routing layer, not just the bait. So the fact that the question says "malicious code... that redirects traffic" is your dead giveaway, because that is the definition of pharming down to the letter. Saw almost this exact wording on my 1D0-61C last spring and I almost second-guessed myself into picking Spoofing. Spoofing is more about faking an identity or address at the packet level, not installing redirect code on an endpoint. Once I remembered that pharming hits the machine or the DNS server itself and does the redirecting silently, I locked in A and moved on. Glad I studied that distinction because it came up again in a slightly different scenario later in the same exam.
Fatima Z.May 14, 2026Solid breakdown, and the hook I use to never mix them up is this: PHARMing poisons the FARM (the soil, meaning the DNS or the machine itself) so every crop that grows is fake no matter what seed you plant, while phiSHING still needs you to bite the hook, so if the question mentions redirects happening WITHOUT user error, you are always in pharming territory.
Fatima Z.May 9, 2026Pharming plants code that hijacks DNS so you land on a fake site silently.
Orla P.May 25, 2026Honestly I almost went with C because phishing was the first word that popped into my head when I read "imposter Web site," but then I caught the detail about malicious code being installed to redirect traffic at the DNS or hosts-file level, and that is the whole point of pharming, it hijacks the route itself rather than just tricking you with a fake link in an email. Once you see that the attack is about the redirect mechanism rather than the lure, A locks in pretty fast.
Naledi M.May 25, 2026The redirect mechanism framing is exactly right, and it is worth adding that the hosts-file variant is especially insidious from a user-trust standpoint because the URL in the address bar looks completely legitimate, which removes the visual cue that most accessibility and usability guidance tells users to rely on as a safety check.