100-160 Question 128
Select 2You are a cybersecurity technician investigating a potential DNS spoofing attack on your organization’s network. Which of the following tools would help you verify the IP address associated with a suspicious domain and capture network traffic for further analysis?
- A
nslookup
- B
netstat
- C
tcpdump
- D
ping
- E
traceroute
Show answer and explanation
Correct answers: A, C
Explanation
For investigating a DNS spoofing attack, you need tools that can verify DNS information and analyze network traffic. nslookup is ideal for querying DNS records to verify the accuracy of the domain-to-IP resolution, while tcpdump allows you to capture and analyze packets to identify suspicious traffic or DNS anomalies. Together, these tools provide comprehensive insight into potential DNS spoofing attempts.
- A. Correct.
nslookup is used to query DNS records and verify the IP address associated with a domain name. It is essential for investigating DNS-related issues such as spoofing.
- B. Incorrect.
netstat is used to display active network connections and listening ports, but it does not directly help in querying DNS records or capturing traffic.
- C. Correct.
tcpdump is a packet-sniffing tool that can capture network traffic for analysis, making it useful for investigating potential DNS spoofing or other network attacks.
- D. Incorrect.
ping is used to test connectivity to a host but does not provide DNS record information or network traffic capture capabilities.
- E. Incorrect.
traceroute is used to map the route packets take to a destination but is not directly used for querying DNS records or capturing traffic.