312-49 · Question #91
Jason, a renowned forensic investigator, is investigating a network attack that resulted in the compromise of several systems in a reputed multinational's network. He started Wireshark to capture…
The correct answer is A. DNS Poisoning. DNS Poisoning (also called DNS Cache Poisoning) occurs when an attacker injects malicious, forged DNS records into a resolver's cache, causing DNS queries to return a fraudulent IP address instead of the legitimate one. Jason's key finding - that DNS packets are being routed to…
Question
Jason, a renowned forensic investigator, is investigating a network attack that resulted in the compromise of several systems in a reputed multinational's network. He started Wireshark to capture the network traffic. Upon investigation, he found that the DNS packets travelling across the network belonged to a non-company configured IP. Which of the following attack Jason can infer from his findings?
Options
- ADNS Poisoning
- BCookie Poisoning Attack
- CDNS Redirection
- DSession poisoning
How the community answered
(35 responses)- A74% (26)
- B14% (5)
- C6% (2)
- D6% (2)
Explanation
DNS Poisoning (also called DNS Cache Poisoning) occurs when an attacker injects malicious, forged DNS records into a resolver's cache, causing DNS queries to return a fraudulent IP address instead of the legitimate one. Jason's key finding - that DNS packets are being routed to a non-company-configured IP - is the classic indicator of DNS poisoning: the DNS cache has been corrupted to redirect traffic to an attacker-controlled server. DNS Redirection (C) is typically an outcome or a broader category, while DNS Poisoning specifically describes the attack method of corrupting DNS records. Cookie Poisoning (B) and Session Poisoning (D) are web application attacks unrelated to DNS traffic anomalies.
Topics
Community Discussion
No community discussion yet for this question.