What is the first step for a hacker conducting a DNS cache poisoning (DNS spoofing) attack against an organization?

Question

Options

• AThe attacker queries a nameserver using the DNS resolver.
• BThe attacker makes a request to the DNS resolver.
• CThe attacker forges a reply from the DNS resolver.
• DThe attacker uses TCP to poison the ONS resofver.

• B
  92% (24)
• C
  4% (1)
• D
  4% (1)

Explanation

DNS Cache Poisoning: First Step Explained

Option B is correct because DNS cache poisoning begins when the attacker initiates a request to the DNS resolver, essentially triggering the resolution process that they intend to exploit - without this initial request, there is no lookup to intercept or manipulate.

Why the distractors are wrong:

• Option A describes a later step where the DNS resolver queries an authoritative nameserver - this happens after the initial request is made, not before.
• Option C describes forging a reply, which is the core attack action but occurs further down the attack chain, after the resolver has already been engaged.
• Option D is incorrect because DNS primarily uses UDP (not TCP) for standard queries, making "TCP poisoning" factually misleading, and this also does not describe a first step.

Memory Tip: Think of the attack like a race - the attacker must first place a bet (make a request) before they can rig the outcome (forge the reply). The sequence is: Request → Resolver queries nameserver → Attacker forges faster fake reply → Cache gets poisoned. Remember: no request = no race to win.

No community discussion yet for this question.