312-50 Question 196
Single answer▪ Sniffing Technique: DNS PoisoningDuring an authorized internal assessment, you are connected to the same switched LAN as several employee workstations. Users report that when they browse to the company payroll portal by its normal hostname, they are intermittently sent to a cloned login page hosted on another internal system. Packet captures show the victims first send ARP requests for the default gateway, then DNS queries to the corporate DNS server, but the DNS replies reaching the victims contain a forged A record mapping the payroll hostname to the attacker's IP address. Which attack sequence best explains this behavior?
- A
The attacker performed ARP spoofing to position themselves as a man-in-the-middle, then injected forged DNS responses before the legitimate DNS server's reply arrived
- B
The attacker conducted a SYN flood against the DNS server so clients automatically switched to LLMNR and resolved the payroll hostname from broadcast traffic
- C
The attacker modified the authoritative public DNS zone for the payroll domain by exploiting a zone transfer misconfiguration on the Internet-facing name server
- D
The attacker sent ICMP redirect messages to victims, causing browsers to ignore DNS and connect directly to the cloned site by hostname
Show answer and explanation
Correct answer: A
Explanation
The best answer is the ARP-spoofing-plus-forged-DNS-reply sequence. In real-world LAN attacks, an adversary commonly uses ARP cache poisoning to place themselves between a victim and the gateway or DNS server. Once in the middle, the attacker can observe DNS queries and race the legitimate DNS server by sending a spoofed response with a malicious A record. If the forged reply arrives first and appears believable to the client, the victim may connect to the attacker's host instead of the real service. This aligns with CEH coverage of sniffing and poisoning techniques, where ARP spoofing is frequently used to enable DNS poisoning on switched networks. As a defensive best practice, organizations should use dynamic ARP inspection, DHCP snooping, switch port security, DNSSEC where applicable, encrypted DNS transport where supported, and TLS certificate validation/HSTS to reduce the impact of forged DNS responses. Guidance from vendors and standards bodies such as RFC 826 (ARP), RFC 3833 (threats to DNS), and DNSSEC-related RFCs supports these mitigations.
- A. Correct.
Correct. This is a classic DNS poisoning scenario on a local network: the attacker first uses ARP spoofing/ARP cache poisoning to become the path between the victim and the gateway or DNS server, then forges DNS replies so the victim caches or immediately uses the malicious record. The scenario explicitly mentions forged DNS replies reaching the victims after ARP activity, which strongly indicates a man-in-the-middle position combined with DNS response injection.
- B. Incorrect.
Incorrect. A SYN flood is a denial-of-service technique, not the most direct way to produce forged DNS answers seen in packet captures. Also, clients do not normally 'automatically switch' from standard DNS to LLMNR for a normal, resolvable corporate FQDN simply because the DNS server is under load. The observed forged DNS reply points to response spoofing, not fallback name-resolution behavior.
- C. Incorrect.
Incorrect. Compromising the authoritative public DNS zone could redirect users globally, but it does not fit the packet-level evidence here. The victims are on an internal LAN querying the corporate DNS server, and the forged reply is seen reaching the victim on that segment. That pattern is much more consistent with local interception and spoofing than with a change to the external authoritative zone.
- D. Incorrect.
Incorrect. ICMP redirects can influence routing decisions, but they do not cause browsers to bypass DNS resolution for a hostname. Users still need an IP address for the payroll hostname, and the scenario specifically states the DNS replies themselves contain the forged A record. That makes DNS poisoning the key mechanism, not ICMP redirect alone.