N10-009 Question 266
Single answerVLAN hopping, Media Access Control (MAC) flooding, Address Resolution Protocol (ARP) poisoning, ARP spoofing, DNS poisoning, DNS spoofingA network administrator is investigating reports that users can initially reach the company payroll website by typing the correct internal URL, but after a few minutes they are silently redirected to a fraudulent page that looks identical. Endpoint antivirus shows no malware, and switching affected users to a different browser does not help. Packet captures show clients sending DNS queries to the correct internal DNS server, but the server is replying with an incorrect IP address for the payroll host. Which attack best explains this behavior?
- A
MAC flooding
- B
ARP spoofing
- C
DNS poisoning
- D
VLAN hopping
Show answer and explanation
Correct answer: C
Explanation
The best answer is DNS poisoning. The key clue is that clients are using the correct DNS server, but that server is returning an incorrect IP address for the internal payroll site. That means the name-resolution data being served is malicious or corrupted. By contrast, ARP spoofing/ARP poisoning affects local Layer 2 address resolution between IP and MAC addresses and is commonly used for man-in-the-middle attacks on a subnet, but it does not typically cause the DNS server itself to return bad records. MAC flooding targets switch forwarding behavior, and VLAN hopping targets VLAN isolation.
In practice, administrators should verify the DNS server's cache and authoritative records, clear poisoned cache entries if needed, restrict recursive queries, enable DNSSEC validation where supported, patch DNS software, and review access controls on DNS administration. These actions align with common DNS security best practices published by vendors and organizations such as CISA, NIST, and major DNS platform providers.
- A. Incorrect.
MAC flooding is a Layer 2 attack against a switch's CAM/MAC address table. An attacker overwhelms the table with many fake source MAC addresses so the switch may begin flooding frames out multiple ports, potentially enabling eavesdropping. This does not fit the scenario because the packet capture shows the DNS server itself returning the wrong IP address, which points to corrupted name resolution data rather than switch table exhaustion.
- B. Incorrect.
ARP spoofing manipulates IP-to-MAC mappings on a local subnet, often to place the attacker in a man-in-the-middle position. While ARP spoofing can redirect traffic, the evidence here is that clients query the legitimate DNS server and receive an incorrect DNS answer from that server. That is more consistent with poisoned DNS records or cache data than altered ARP entries on the client LAN.
- C. Correct.
DNS poisoning is correct because it involves corrupting DNS data, such as a resolver cache or zone information, so a legitimate DNS server responds with a malicious or incorrect IP address for a hostname. In this scenario, users query the proper internal DNS server, yet that server replies with a fraudulent address for the payroll site. That symptom directly matches DNS poisoning.
- D. Incorrect.
VLAN hopping is an attack used to gain unauthorized access to traffic on another VLAN, commonly through switch spoofing or double-tagging in poorly configured environments. Although it can expose traffic segmentation weaknesses, it does not specifically explain why the DNS server is answering with an incorrect IP address for a known hostname.