What is the first step for a hacker conducting a DNS cache poisoning (DNS spoofing) attack against an organization?

The attacker initiates the attack by sending a query to a nameserver via the DNS resolver, which forces the resolver to issue a lookup request to the authoritative nameserver. This creates the timing window the attacker needs to inject a forged response before the legitimate reply arrives and is cached.

Making a request to the DNS resolver describes a general client action - it is not specific to the attacker's role of querying a nameserver to trigger the resolver's upstream lookup.

Forging a reply from the DNS resolver is a later step that only becomes possible after the resolver has been triggered to send an authoritative query - it cannot occur first.

DNS cache poisoning exploits UDP rather than TCP because UDP's connectionless, stateless nature makes it easy to spoof unsolicited replies; TCP's handshake prevents this technique.