A penetration tester has obtained access to an IP network subnet that contains ICS equipment intercommunication. Which of the following attacks is MOST likely to succeed in creating a physical effect?

In ICS environments where HMIs, engineering workstations, or historians resolve hostnames to communicate with controllers, poisoning the DNS cache allows an attacker to redirect that traffic to a rogue system. The attacker can then intercept or forge control messages - such as setpoint changes or actuator commands - causing measurable physical consequences in the controlled process.

Record and replay attacks are effective against unauthenticated ICS protocols but depend on having pre-captured valid command sessions and precise timing, making them less immediately available to an attacker who has just gained subnet access.

Exploiting SMB on a supervisory server would require successful exploitation plus additional lateral movement before any physical control plane could be reached, adding significant complexity and steps.

Blind SQL injection targets database-backed web applications and has no applicability to ICS field-device communication protocols such as Modbus, DNP3, or EtherNet/IP.