The attacker must be connected to the LAN and sniff the DNS request IDs to respond before the legitimate DNS server is known. This attack is called what?

The attacker must be connected to the LAN and sniff the DNS request IDs to respond before the legitimate DNS server is known. This attack is called what?

• A. Internet DNS poisoning
• B. DNS cache poisoning
• C. Proxy server DNS poisoning
• D. Intranet DNS spoofing attack

Answer: (D)

This tests DNS spoofing on an internal network. An attacker who is on the LAN can watch DNS queries and grab the transaction IDs, then send a forged DNS response that matches those IDs and arrives before the real DNS server’s reply. If the resolver accepts the forged answer, it caches the attacker’s IP for that domain, redirecting traffic to the attacker. Because this attack is carried out within the intranet, it’s described as an intranet DNS spoofing attack. The other terms are less precise for this scenario: Internet DNS poisoning usually implies poisoning caches at external or widely distributed resolvers, not confined to the local network; DNS cache poisoning is a general concept and could happen anywhere, but does not specify the intranet context; proxy server DNS poisoning would involve a proxy rather than the DNS resolver directly, which isn’t the described method.

This tests DNS spoofing on an internal network. An attacker who is on the LAN can watch DNS queries and grab the transaction IDs, then send a forged DNS response that matches those IDs and arrives before the real DNS server’s reply. If the resolver accepts the forged answer, it caches the attacker’s IP for that domain, redirecting traffic to the attacker. Because this attack is carried out within the intranet, it’s described as an intranet DNS spoofing attack.

The other terms are less precise for this scenario: Internet DNS poisoning usually implies poisoning caches at external or widely distributed resolvers, not confined to the local network; DNS cache poisoning is a general concept and could happen anywhere, but does not specify the intranet context; proxy server DNS poisoning would involve a proxy rather than the DNS resolver directly, which isn’t the described method.