Examkin

Question

Difficulty: MediumNetwork and Wireless Attack Indicators

A network security administrator investigates SIEM alerts after several workstation users report reaching an untrusted website when typing the domain name of an internal portal. Inspection of logs from the primary recursive DNS resolver reveals thousands of unsolicited UDP port 5353 response packets arriving within a fraction of a second. These responses contain forged IP address mappings for the internal portal domain and attempt to match outgoing query transaction IDs (TXIDsTXIDs) before the legitimate authoritative server replies. Which of the following network attacks is indicated by these log entries?

  1. DNS cache poisoningAnswer
  2. B
    ARP cache poisoning
  3. C
    MAC flooding
  4. D
    VLAN hopping

Answer

DNS cache poisoning
The correct answer is DNS cache poisoning. This attack occurs when an adversary sends a burst of spoofed DNS responses with randomized transaction IDs (TXIDs) to a recursive DNS resolver. If a forged response matches the TXID of an active outbound request before the legitimate authoritative server responds, the resolver caches the false IP address mapping and directs users to a malicious site.

Step-by-Step Solution

1
Analyze the observed log indicators and traffic behavior.
The logs demonstrate a high volume of unsolicited UDP port 53 responses targeting a recursive resolver to match query transaction IDs (TXIDs) and alter domain IP resolutions.
Attackers perform brute-force transaction ID matching to inject malicious DNS resource records into a resolver's cache before the legitimate authoritative DNS server responds.
2
Correlate the technical indicators with specific network attack definitions.
Corrupting domain-name-to-IP-address resolution entries stored in a caching DNS server is the defining characteristic of DNS cache poisoning.
This redirection allows attackers to divert user traffic from legitimate domain destinations to malicious IP addresses without modifying client system host files.

Key Concept

DNS Cache Poisoning Indicators
Rate this question

Topics

Network and Wireless Attack Indicators

More questions from this topic