A systems administrator notices an increase in errors in a DNS server log. Further investigation determines the errors are related to incoming DNS packets with incorrect query ID's. What type of activ

Clients browsing blocked websites generate NXDOMAIN responses or policy-based redirects, not a flood of packets with mismatched query IDs.

Unauthorized zone transfer requests use AXFR or IXFR DNS record types directed at the authoritative server, which would not produce query ID mismatch errors.

Bot command and control traffic typically uses legitimate DNS queries with valid, matching query IDs to resolve C2 domain names, not malformed packets.

DNS cache poisoning attacks work by flooding a DNS resolver with forged response packets bearing spoofed source IPs and guessed or predicted transaction (query) IDs, hoping one matches an outstanding query before the legitimate response arrives. When the attacker's guesses are wrong, the DNS server logs errors due to mismatched query IDs on incoming packets. A high volume of these errors strongly indicates an active poisoning attempt targeting the resolver's cache.