Examkin

Soru

Zorluk: OrtaCommon Network Attack Types and Vectors

During an incident response investigation, a network security analyst discovers that internal users attempting to connect to a partner organization's remote server were redirected to an untrusted external host. Analysis reveals that client workstations issued standard domain name lookup requests, but the enterprise's recursive resolver returned forged IP address records that had been injected into its local cache. Which of the following attack types best describes this security incident?

  1. DNS cache poisoningCevap
  2. B
    ARP poisoning
  3. C
    Port and protocol mismatch exploit
  4. D
    DNS record type misapplication

Cevap

DNS cache poisoning is the correct attack type, as it involves injecting invalid IP address resolutions into a caching DNS server to redirect user traffic.
DNS cache poisoning (also known as DNS spoofing) occurs when an attacker introduces false resolution data into a DNS resolver's cache. As a result, subsequent queries for the compromised domain return the attacker's fake IP address, redirecting legitimate users to malicious sites without modifying client configurations.

Adım Adım Çözüm

1
Analyze the incident symptoms presented in the scenario.
Identified that client workstations issued standard domain name requests, but received corrupted IP address mappings cached on the internal resolver.
Understanding the precise vector differentiates Layer 2 address resolution attacks from Layer 7 domain resolution attacks.
2
Compare candidate attack vectors against domain name resolution mechanisms.
Confirmed that malicious injection of false domain-to-IP mappings into a recursive DNS server is defined as DNS cache poisoning (DNS spoofing).
Corrupting nameserver lookup entries diverts user connections at the domain resolution phase.

Anahtar Kavram

DNS Cache Poisoning and Network Attack Vectors
Tahmini Süre:1m 15s
Bu soruyu puanla

Konular

Common Network Attack Types and Vectors

Bu konudan daha fazla soru